Re: [TLS] Security today

[Eric Rescorla <ekr at networkresonance.com>]

At Fri, 28 Mar 2008 21:14:30 -0700,
Mike wrote:
> 
> >> I think that it's become necessary for the TLS WG to put
> >> together a document with hard numbers in it for key lengths,
> >> relative strengths, expected lifetime for data protected by
> >> those keys/lengths/algorithms.
> > 
> > RFC 3766.
> 
> Thanks for the pointer to that document; I hadn't seen it before.
> However, the document I think we need would merely use that RFC
> as a (important) reference.  In particular it doesn't mention
> TLS at all or its key exchange mechanisms.  It also seems to be
> written for cryptographers, not your average programmer.
> 
> The things that I think need to be spelled out are things like
> forward secrecy.  For example, the RSA key for an RSA_* cipher
> suite needs to be much stronger than the RSA key for DHE_RSA_*
> since breaking the latter doesn't reveal anything about any
> past sessions, while breaking the former reveals everything
> about every past session.
>
> Also after breaking the key, you can passively listen in on any
> future sessions based on RSA_* without much risk of detection,
> but to get anything out of future DHE_RSA_* sessions, you need
> to actively insert yourself in the middle.

This is all well-known material amply covered in the cryptographic
literature. I don't see any benefit in the TLS WG rehashing
this territory.

-Ekr

_______________________________________________
TLS mailing list
TLS at ietf.org
https://www.ietf.org/mailman/listinfo/tls