Part 1: General - Computer Security Resource Center - National ...

March, 2007
6. Identification of all information that may be compromised as a result of the incident,
7. Identification of all signatures that may be invalid due to the compromise of a signing
key, and
8. Distribution of new keying material, if required.
5.6 Guidance for Cryptographic Algorithm and Key Size Selection
Cryptographic algorithms that provide the security services identified in Section 3 are specified
in Federal Information Processing Standards (FIPS) and NIST Recommendations. Several of
these algorithms are defined for a number of key sizes. This section provides guidance for the
selection of appropriate algorithms and key sizes.
This section emphasizes the importance of acquiring cryptographic systems with appropriate
algorithm and key sizes to provide adequate protection for 1) the expected lifetime of the system
and 2) any data protected by that system during the expected lifetime of the data.
5.6.1 Comparable Algorithm Strengths
Cryptographic algorithms provide different “strengths” of security, depending on the algorithm
and the key size used. In this discussion, two algorithms are considered to be of comparable
strength for the given key sizes (X and Y) if the amount of work needed to “break the algorithms”
or determine the keys (with the given key sizes) is approximately the same using a given
resource. The security strength of an algorithm for a given key size is traditionally described in
terms of the amount of work it takes to try all keys for a symmetric algorithm with a key size of
"X" that has no short cut attacks (i.e., the most efficient attack is to try all possible keys). In this
case, the best attack is said to be the exhaustion attack. An algorithm that has a "Y" bit key, but
whose strength is comparable to an "X" bit key of such a symmetric algorithm is said have a
“security strength of X bits” or to provide “X bits of security”. Given a few plaintext blocks and
corresponding cipher, an algorithm that provides X bits of security would, on average, take 2 X-1 T
of time to attack, where T is the amount of time that is required to perform one encryption of a
plaintext value and comparison of the result against the corresponding ciphertext value.
Determining the security strength of an algorithm can be nontrivial. For example, consider
TDEA. TDEA uses three 56-bit keys (K1, K2 and K3). If each of these keys is independently
generated, then this is called the three key option or three key TDEA (3TDEA). However, if K1
and K2 are independently generated, and K3 is set equal to K1, then this is called the two key
option or two key TDEA (2TDEA). One might expect that 3TDEA would provide 56 × 3 = 168
bits of strength. However, there is an attack on 3TDEA that reduces the strength to the work that
would be involved in exhausting a 112-bit key. For 2TDEA, if exhaustion were the best attack,
then the strength of 2TDEA would be 56 × 2 = 112 bits. This appears to be the case if the
attacker has only a few matched plain and cipher pairs. However, if the attacker can obtain
approximately 2 40 such pairs, then 2TDEA has strength comparable to an 80-bit algorithm (see
[ANSX9.52], Annex B).
The recommended comparable key size classes discussed in this section are based on
assessments made as of the publication of this recommendation using currently known methods.
Advances in factoring algorithms, advances in general discrete logarithm attacks, elliptic curve
discrete logarithm attacks and quantum computing may affect these equivalencies in the future.
New or improved attacks or technologies may be developed that leave some of the current
61