1
$\begingroup$

Recently (2016) I've been researching on post-quantum digital signature schemes, and read about BLISS, BLZZRD, REBLISS schemes. What I've noticed about them is that they lack a parameter set for 256-bit security level.

I went to the Wikipedia page on NSA Suite B and learned that CNSSP-15 require only 384-bit curve for digital signature. And then I clicked on this link in the reference section at the bottom of the page, and found out only ECDSA-with-SHA{256,386} required for the profile.

It baffles me. Why is 192-bit security sufficient (upper-limit if you will) for digital signatures when we have 256-bit variant of AES? And what reference backs this up?

Improve this question
$\endgroup$
2
  • $\begingroup$ We still consider brute force for 128 bit to be far beyond what's possible with our computers - given all the computation power in the world and enough time until the sun burns out. Keep in mind, every extra bit doubles the computational effort. So 192 bit is $18,446,744,073,709,551,616$ times longer than 128 bit. At some point, it doesn't make sense to go higher, even if it is possible. However, using larger numbers for the curve does increase the necessary calculations to use the system. $\endgroup$
    – tylo
    Nov 3, 2016 at 10:44
  • $\begingroup$ While key sizes larger than 192 bits have some justification (resisting quantum computers, multi-target attacks, etc.), security levels above 192 bits are all squarely in the "unbreakable" region. $\endgroup$
    – CodesInChaos
    Nov 3, 2016 at 15:50

2 Answers 2

Reset to default
2
$\begingroup$

The trivial answer is that there doesn't exist any relevant security threats that entail a requirement for long term authentication. There do however exist relevant security threats that warrant long term confidentiality.

Assume you have a document and need to prove its authenticity. If you apply a digital signature to the document, but the digital signature scheme you use is later broken, it might still be possible for you to later reestablish the authenticity of the document using other means. For instance, there might be external witnesses that can vouch for the authenticity, the document might be recorded in multiple locations, making forgeries reasonably unlikely, etc.

However, if you encrypt the document for confidentiality and the encryption scheme is broken, there is no way for you to ever reestablish reasonable confidentiality guarantees. If the document is no longer confidential, re-encrypting it obviously won't restore confidentiality.

Improve this answer
$\endgroup$
1
  • $\begingroup$ So it boils down to purpose rather than strength. I really do have to turn my heads around a bit. :-) $\endgroup$
    – DannyNiu
    Nov 3, 2016 at 10:58
0
$\begingroup$

You may find this CFRG email discussion interesting, particularly this email from Kevin Igoe of the NSA:

In fact we had wanted to use AES -128 and AES-192, but a quick survey of AES implementations (hardware centric, I believe) showed that there were very few implemented AES-192, whence the decision to go with AES-128 and AES-256 in Suite B, paired with P256 and P384. All of the crypt purists grumbled endlessly about the mismatch betwixt AES-256 and P384.

It seems that NSA thought that 192 bit security levels were sufficient and only included AES-256 because it was much more widely implemented than AES-192. The use of P-384 makes sense in this context.

Improve this answer
$\endgroup$
2
  • $\begingroup$ But then again, how much can we trust NSA? (I definitely thank you for leading me to this.) $\endgroup$
    – DannyNiu
    Nov 3, 2016 at 15:05
  • $\begingroup$ I can't think of a malicious reason to go with a 192 bit security level. We'd have to assume that they can break AES-128 and AES-192, but not AES-256; or that they can break P-256 and P-384, but not P-521. That would be a really strange scenario. It's more likely that they just have a realistic view of the security level that is necessary and don't see a reason to take the performance hit of larger keys. $\endgroup$
    – user40185
    Nov 3, 2016 at 16:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.