[TLS] security levels for TLS

["Nikos Mavrogiannopoulos" <nmav at gnutls.org>]

Hello,
 It seems that in TLS the security level of a connection relies on
several factors including the ciphersuite. In certificate
authentication the certificate plays also a large factor in the
security, and especially the public key of it, plus the signer's
public key.

This is not visible and neither understandable in everyday work with
TLS by typical users. For example a browser connection to a site with
a 512 bit RSA key that negotiated an 128 bit ciphersuite will not
differ to a connection with a 2048 bit RSA key and the same
ciphersuite, with regard to visible user data. This makes difficult
for users to judge the security level of the connection and one must
never assume that a user would understand what a 512 bit RSA key
means.

For this reason I think using some form of uniform security levels to
indicated TLS security would be useful in end-applications. Those
levels could be defined in steps (as in [0]), based on objective
information of the key sizes in the certificates, the DHE prime and
generator sizes (if applicable), the MAC output size of the
ciphersuite as well as the key size of the cipher.

Then the security level could be printed either as a number (70 bits
of security) or as "weak, low, medium, high" based on some definitions
of these terms... I could make it more detailed if there is some
interest. What do you think?

regards,
Nikos

[0]. "Practical Cryptography", Fergunson, Schneier

_______________________________________________
TLS mailing list
TLS at lists.ietf.org
https://www1.ietf.org/mailman/listinfo/tls