[TLS] Security today

[Mike <mike-list at pobox.com>]

Is anyone else concerned about the level of security on the
Internet today?  I mean everybody is using 1024-bit RSA keys
which have an estimated 80 bits of security.  (Yet CA's are
happy to claim that you get 128 or even 256 bits of security
using them for SSL.)  RSA Labs even states that 1024-bit keys
are good only until 2010, and they estimate 2048-bit keys
will protect data until 2030.  Why use such small margins
anyway?  Processors are already super fast and getting even
faster.  Who cares if it takes an extra half second to buy a
book if your financial data will be secure for several more
decades?

Not only will 1024-bit keys be broken "soon", but when that
happens, it's not just a matter of replacing keys -- any data
transmitted over a channel using plain RSA key exchange has
no forward secrecy, and is thus exposed.  An added problem is
that lots of websites will purposely ignore higher-security
cipher suites (that do provide forward secrecy) early in the
cipher list and choose RSA_WITH_RC4 preferentially, probably
because it is slightly faster.  Even more fuel to the fire is
the fact that many websites have disabled DHE_* cipher suites
in the past few months (I thought my TLS test client was
broken because sites that I used to connect to with DHE no
longer negotiate it).

What will it take to affect a change in this state of affairs
that treats 1024-bit keys as secure?

Mike
_______________________________________________
TLS mailing list
TLS at ietf.org
https://www.ietf.org/mailman/listinfo/tls