Subject: Forwarded mail....

From: Markku-Juhani Saarinen <[email-masked]>
Date: Wed, 4 Oct 2000 12:45:22 +0300 (EET DST)

Ok, perhaps it is better to use "rijndael" for now.. But what's
the concensus on the key length issue ? 

  "rijndael128-cbc"   recommended ?
  "rijndael192-cbc"   recommended ?
  "rijndael256-cbc"   recommended ?

By the way, secsh will not have have > 2^80 security against certain key
derivation attacks before the adoptation of SHA-2.

> Also I am not sure the analogy with Lucifer/DES holds since Lucifer was
> another cipher. There is a thread on exactly this topic in sci.crypt at
> the moment.

Actually my understanding is that many IBM block ciphers prior to
DES were called "Lucifer", as was IBM's submission to NBS in 1974. At
least two variants of Lucifer are discussed in Biham's and Shamir's '93
book on differential cryptanalysis.

This algorithm was heavily modified (with the help of NSA) during
the 3-year selection process and was ultimately selected as the DES in
1977. 

Cheers,
- mj

Markku-Juhani O. Saarinen <[email-masked]>  University of Jyväskylä, Finland

---

From: [email-masked] (Niels M�ller)
Date: 04 Oct 2000 13:40:08 +0200

>   "rijndael256-cbc"   recommended ?

Hmm. My first reaction was that I would rather use "rijdael-256-cbc"
etc, analogous to "hmac-md5-96". But on the other hand, you're naming
is more consistent with "cast128-cbc". Using consistent naming
conventions isn't crucial for interoperability or some such, but it
makes the spec look a lot cleaner.

I don't have any strong opinion on whether or not the algorithms
should be recommended. To me, it seems reasonable to make
"rijndael256-cbc" RECOMMENDED (analogous to the recommended
"twofish-cbc", which also uses 256 bit keys), and make the shorter-key
variants OPTIONAL.

(And BTW, when talking about algorithm names, I'd like to remind you
that "hmac-sha-96" ought to be changed to "hmac-sha1-96").

Regards,
/Niels