Re: [TLS] Proposed text for IDEA/DES document

[<Pasi.Eronen at nokia.com>]

Here's an update to the text proposal, incorporating many of 
the comments received so far:

N.  Security Considerations

N.1.  DES Cipher Suites

   DES has an effective key strength of 56 bits, which has been been
   known to be vulnerable to practical brute force attacks for over 20
   years [DH].  A relatively recent 2006 paper by Kumar et al.  [COPA]
   describes a system which performs exhaustive key search in less than
   nine days on average, and costs less than 10,000 USD to build.

   Given these, the single-DES cipher suites SHOULD NOT be implemented
   by TLS libraries.  If a TLS library implements these cipher suites,
   it SHOULD NOT enable them by default.  Experience has also shown that
   rarely used code is a source of security and interoperability
   problems, so existing implementations SHOULD consider removing these
   cipher suites.

N.2.  IDEA Cipher Suites

   IDEA has a 128-bit key, and thus is not vulnerable to exhaustive key
   search.  However, IDEA cipher suites for TLS have not seen widespread
   use: most implementations either do not support them, do not enable
   them by default, or do not negotiate them when other algorithms (such
   as AES, 3DES, or RC4) are available.

   Experience has shown that rarely used code is a source of security
   and interoperability problems; given this, the IDEA cipher suites
   SHOULD NOT be implemented by TLS libraries, and SHOULD be removed
   from existing implementations.  If a TLS library implements these
   cipher suites, it SHOULD NOT enable them by default.

   (To be determined: should we include text speculating why IDEA has
   been rarely used, including e.g. reasons mentioned on the list so
   far?  This would include at least IPR, performance in software, short
   block size, and lack of government approval in many countries.)

The last paragraph of IDEA text obviously needs work (if we choose
to include some of those reasons), and we need to be careful to
distinguish facts (where everyone agrees) and personal opinions
(and in worst case, FUD). 

Comments?

Best regards,
Pasi
_______________________________________________
TLS mailing list
TLS at ietf.org
http://www.ietf.org/mailman/listinfo/tls