Subject: [eap] Proposed text for Issue 79 (Key strength estimate)

From: [email-masked] ([email-masked])
Date: Wed, 12 Feb 2003 17:54:18 +0200

Here's my shot at Issue 79:

  [d] Key strength. If the method derives keys, then the effective key
  strength MUST be estimated. This estimate is meant for potential users
  of the method to determine if the keys produced are strong enough for
  the intended application.

  The effective key strength SHOULD be stated as number of bits, defined
  as follows: If the effective key strength is N bits, the best
  currently known methods to recover the key (with non-negligible
  probability) require an effort comparable to 2^N operations of=20
  a typical block cipher. The statement SHOULD be accompanied by a=20
  short rationale, explaining how this number was arrived at.

  (Note: Although it is difficult to define what "comparable effort" and
  "typical block cipher" exactly mean, reasonable approximations are
  sufficient here. Refer to e.g. [SILVERMAN] for more discussion.)

  The key strength depends on the methods used to derive the keys.
  For instance, if keys are derived from a shared secret (such as a=20
  password or master key), and possibly some public information =20
  such as nonces, the effective key strength is limited by the
  entropy of the long-term secret (assuming that the derivation=20
  procedure is computationally simple). To take another example, when=20
  using public key algorithms, the strength of the symmetric key=20
  depends on the strength of the public keys used.

And add this to "Informative References":

  [SILVERMAN]
  Robert D. Silverman: A Cost-Based Security Analysis of Symmetric and
  Asymmetric Key Lengths. RSA Laboratories Bulletin 13, April 2000
  (Revised November 2001).
  http://www.rsasecurity.com/rsalabs/bulletins/bulletin13.html

(I know that there are other papers about the same subject as
Silverman's, some of which present somewhat different estimates
about how strong various key lengths are, but for this purpose,
a rough estimate is probably good enough)

Best regards,
Pasi