Commit 55567cf
doc: remove faulty justification for 128-bit AES
This sentence implies that AES-128 is preferred over AES-256 because
of a related-key attack from 2009. However, that attack by Alex
Biryukov, Orr Dunkelman, Nathan Keller, Dmitry Khovratovich, and Adi
Shamir, while impressive, is only effective against variants of
AES-256 with a reduced number of rounds and it requires related keys.
This means that the attack is not effective against AES-256 as it is
used within TLS.
(AES-128 is still often preferred over AES-256 simply because it is
believed to be sufficiently secure and because it is faster.)
PR-URL: #42578
Reviewed-By: Rich Trott <rtrott@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Mestery <mestery@protonmail.com>
Reviewed-By: Mohammed Keyvanzadeh <mohammadkeyvanzade94@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>1 parent 6d2d2b5 commit 55567cf
1 file changed
Lines changed: 0 additions & 4 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -385,9 +385,6 @@ The default cipher suite prefers GCM ciphers for [Chrome's 'modern | |||
| 385 | 385 | cryptography' setting][] and also prefers ECDHE and DHE ciphers for perfect | |
| 386 | 386 | forward secrecy, while offering _some_ backward compatibility. | |
| 387 | 387 | ||
| 388 | - 128 bit AES is preferred over 192 and 256 bit AES in light of [specific | ||
| 389 | - attacks affecting larger AES key sizes][]. | ||
| 390 | - | ||
| 391 | 388 | Old clients that rely on insecure and deprecated RC4 or DES-based ciphers | |
| 392 | 389 | (like Internet Explorer 6) cannot complete the handshaking process with | |
| 393 | 390 | the default configuration. If these clients _must_ be supported, the | |
@@ -2254,4 +2251,3 @@ added: v11.4.0 | |||
| 2254 | 2251 | [cipher list format]: https://www.openssl.org/docs/man1.1.1/man1/ciphers.html#CIPHER-LIST-FORMAT | |
| 2255 | 2252 | [forward secrecy]: https://en.wikipedia.org/wiki/Perfect_forward_secrecy | |
| 2256 | 2253 | [perfect forward secrecy]: #perfect-forward-secrecy | |
| 2257 | - [specific attacks affecting larger AES key sizes]: https://www.schneier.com/blog/archives/2009/07/another_new_aes.html | ||
0 commit comments