Re: Twofish

[Andrew Bromage <bromage@xxxxxxxxxxx>]

G'day all.

Jon Callas wrote:

> I discussed our previous conversation, and he said that his doubt is merely
> that he is not convinced that the 256-bit keys are fully exponentially
> stronger than 128. I think this is reasonable, and have the same doubts
> myself about all the present generation 256 bit cyphers.

Quite.  We have a precedent in our requirement of 3DES which is
vulnerable to a meet-in-the-middle attack, so we don't expect it to
be fully exponentially stronger than a modern 128 bit cipher.

Cheers,
Andrew Bromage