Part 1: General - Computer Security Resource Center - National ...

March, 2007
protection. In addition, the signature must be generated using a hash algorithm of
comparable or greater strength, such as SHA-224 or SHA-256.
5.6.3 Using Algorithm Suites
Algorithm suites that combine non-comparable strength algorithms are generally discouraged.
However, algorithms of different strengths and key sizes may be used together for performance,
availability or interoperability reasons, provided that sufficient protection is provided. In general,
the weakest algorithm and key size used to provide cryptographic protection determines the
strength of the protection. Exceptions to this principle require extensive analysis. Determination
of the strength of protection provided for information includes an analysis not only of the
algorithm(s) and key size(s) used to apply the cryptographic protection(s) to the information, but
also any algorithms and key sizes associated with establishing the key(s) used for information
protection, including those used by communication protocols.
The following is a list of several algorithm combinations and discussions on the security
implications of the combination:
1. When a key establishment scheme is used to establish keying material for use with one or
more algorithms (e.g., TDEA, AES, or HMAC), the strength of the selected combination
is comparable to the weakest algorithm and key size used. For example, if a 160 bit ECC
key is used to establish a 128-bit AES key (as defined in [SP800-56]), only 80 bits of
security are provided for any information protected by that AES key, since the 160 bit
ECC provides only 80 bits of security. If 128 bits of security are required for the
information protected by AES, then either an ECC key size of at least 256 bits, or another
key establishment algorithm of appropriate key size needs to be selected to provide the
required protection.
2. When a hash function and digital signature algorithm are used in combination to compute
a digital signature, the strength of the signature is determined by the weaker of the two
algorithms. For example, SHA-256 used with RSA using a 1024 bit key provides 80 bits
of security because a 1024 bit RSA key provides only 80 bits of security. If 112 bits of
security is required, a 2048 bit RSA key would be appropriate.
3. When a random bit generator is used to generate a key for a cryptographic algorithm that
is intended to provide X bits of security, an Approved random bit generator shall be used
that provides at least X bits of security.
If it is determined that a specific level of security is required for the protection of data, then an
algorithm and key size suite needs to be selected that would provide that level of security as a
minimum. For example, if 128 bits of security are required for data that is to be communicated
and provided with confidentiality, integrity, authentication and non-repudiation protection, the
following selection of algorithms and key sizes may be appropriate:
a. Confidentiality: Encrypt the information using AES-128. Other AES key sizes would also
be appropriate, but perform a bit slower.
b. Integrity, authentication and non-repudiation: Suppose that only one cryptographic
operation is preferred. Use digital signatures. SHA-256 could be selected for the hash
function. Select an algorithm for digital signatures from what is available to an
application (e.g., ECDSA with at least a 256-bit key). If more than one algorithm and key
67