Re: Key lengths for algorithms for variable-length keys

[nisse%lysator.liu.se@localhost (Niels Möller)]

Ben Harris <bjh21%bjh21.me.uk@localhost> writes:

> transport-23, in section 7.2, says:
> 
>     128 bits (16 bytes) MUST be used for algorithms with variable-length
>     keys.  The only variable key length algorithm defined in this
>     document is arcfour).

I agree this is awkward. I'd suggest the paragraph is cut down from

   Key data MUST be taken from the beginning of the hash output.  128
   bits (16 bytes) MUST be used for algorithms with variable-length
   keys.  The only variable key length algorithm defined in this
   document is arcfour).  For other algorithms, as many bytes as are
   needed are taken from the beginning of the hash value. [...]

to

   Key data MUST be taken from the beginning of the hash output.  As
   many bytes as are needed are taken from the beginning of the hash
   value. [...]

For key length, we already have the general recommendation "All ciphers
SHOULD use keys with an effective key length of 128 bits or more." in
6.3. For arcfour in particular, it may be a little confusing that it's
named "arcfour" rather than "arcfour-128", but the description

   The "arcfour" is the Arcfour stream cipher with 128 bit keys.

makes it clear which key length is used. (Small nit: "cipher" should be
inserted like 

   The "arcfour" cipher is the Arcfour stream cipher with 128 bit keys.

)

For improved clarity, one could also add the arcfour keylength to the
table. Before:

     ...
     serpent128-cbc   OPTIONAL          Serpent with 128-bit key
     arcfour          OPTIONAL          the ARCFOUR stream cipher
     idea-cbc         OPTIONAL          IDEA in CBC mode
     ...

After:

     ...
     serpent128-cbc   OPTIONAL          Serpent with 128-bit key
     arcfour          OPTIONAL          the ARCFOUR stream cipher
                                        with 128 bit key
     idea-cbc         OPTIONAL          IDEA in CBC mode
     ...

> If this stipulation is meant to apply to all future algorithms, it
> seems like a particularly bad idea.  Is it intended to prevent me
> defining "arcfour-256%bjh21.me.uk@localhost" to be RC4 with a 256-bit key, for
> instance?  If not, what does it do?

I agree this doesn't make sense.

Regards,
/Niels