<html><head><meta http-equiv="Content-Type" content="text/html charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">On Jun 30, 2014, at 3:01 PM, Phillip Hallam-Baker <<a href="mailto:phill@hallambaker.com">phill@hallambaker.com</a>> wrote:<br><div><blockquote type="cite"><div dir="ltr"><div class="gmail_extra"><div class="gmail_quote"><blockquote class="gmail_quote" style="margin: 0px 0px 0px 0.8ex; border-left-width: 1px; border-left-color: rgb(204, 204, 204); border-left-style: solid; padding-left: 1ex; position: static; z-index: auto;">So the logical outcome of asking for algorithm agility is ... a single more complex algorithm.<br></blockquote><div><br></div><div>Not really.</div><div><br></div><div>The reason I specify AES as the mandatory to implement algorithm in protocol specifications is that it is the only algorithm currently in use that satisfied all the following criteria:</div>
<div><br></div><div>1) Informed option considers the algorithm to be acceptably secure for all encryption applications.</div><div><br></div><div>2) Is the result of an open selection competition that is generally agreed to have been reasonably transparent and to have made the decision on empirical grounds,</div>
<div><br></div><div>3) Is ubiquitously supported on all platforms including hardware.</div><div><br></div><div>A new more complex algorithm would not meet those criteria. But that is OK because my criteria for a backup algorithm are not the same as my criteria for a default algorithm.</div></div></div></div></blockquote></div>I'm responding to John Kelsey's point that a fallback is only useful if you're willing and able to throw the primary away. You're basically saying that you trust the primary, but will kind of accept the fallback if you're forced to. Not at all the same thing. And if that's really how you feel ... many will argue that the threat to the primary isn't really so bad, we aren't really so confident in the fallback, no one's seen an actual break yet ... and you're left in the position that many won't move to the fallback, so you're forced to use the primary you no longer trust in order to communicate with them.<div><br></div><div>BTW, it's not *a* new, more complex algorithm. The encode side is given</div><div>by:</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>w = select_randomly({0,1})</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>send w</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>if (w == 0)</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>send encryption of data using A</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>else<span class="Apple-tab-span" style="white-space:pre"> </span>send encryption of data using B</div><div><br></div><div>I was being a bit facetious about the "more complex algorithm".</div><div><br><div><div> -- Jerry</div></div><div><br></div></div></body></html>