Re: [TLS] Security today

[Mike <mike-list at pobox.com>]

>> I think that it's become necessary for the TLS WG to put
>> together a document with hard numbers in it for key lengths,
>> relative strengths, expected lifetime for data protected by
>> those keys/lengths/algorithms.
> 
> RFC 3766.

Thanks for the pointer to that document; I hadn't seen it before.
However, the document I think we need would merely use that RFC
as a (important) reference.  In particular it doesn't mention
TLS at all or its key exchange mechanisms.  It also seems to be
written for cryptographers, not your average programmer.

The things that I think need to be spelled out are things like
forward secrecy.  For example, the RSA key for an RSA_* cipher
suite needs to be much stronger than the RSA key for DHE_RSA_*
since breaking the latter doesn't reveal anything about any
past sessions, while breaking the former reveals everything
about every past session.

Also after breaking the key, you can passively listen in on any
future sessions based on RSA_* without much risk of detection,
but to get anything out of future DHE_RSA_* sessions, you need
to actively insert yourself in the middle.

Mike
_______________________________________________
TLS mailing list
TLS at ietf.org
https://www.ietf.org/mailman/listinfo/tls