Reopen AEAD limits

[yaronf]

More detailed analysis in the AEAD limits draft is complicated:

cfrg/draft-irtf-cfrg-aead-limits#40

[yaronf]

Or replace the number with a reference to the CFRG draft, assuming they plan to publish it.

[stpeter]

I will follow up with the CFRG authors.

[thomas-fossati]

I have opened an "help wanted" issue in the AEAD-limits repo.

[yaronf]

Given your discussion, I think I'd rather say "the limits for 1.2 are somewhat higher but for consistency, we recommend the same 2^24.5 for both versions." Because if we cite the 2^28 number, people could easily end up using it with TLS 1.3, too. WDYT?

[thomas-fossati]

Sounds like reasonable advice. I don't think there is any existing recommendation about bounds for GCM forgeries in DTLS 1.2 though (i.e., the q =~ 2^28 number). We probably want to add that.