IETF Logo Mail Archive

Re: [Cfrg] [TLS] 3DES diediedie

Derek Atkins <derek@ihtfp.com> Thu, 08 September 2016 15:01 UTC

Return-Path: <derek@ihtfp.com>
X-Original-To: cfrg@ietfa.amsl.com
Delivered-To: cfrg@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DF0CE12B0DE for <cfrg@ietfa.amsl.com>; Thu, 8 Sep 2016 08:01:35 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2
X-Spam-Level:
X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=ihtfp.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id r3gymEoql2Wr for <cfrg@ietfa.amsl.com>; Thu, 8 Sep 2016 08:01:31 -0700 (PDT)
Received: from mail2.ihtfp.org (mail2.ihtfp.org [IPv6:2001:470:e448:1::3a11]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3AE7212B061 for <cfrg@irtf.org>; Thu, 8 Sep 2016 08:01:31 -0700 (PDT)
Received: from localhost (localhost [127.0.0.1]) by mail2.ihtfp.org (Postfix) with ESMTP id EA9A0E2043; Thu, 8 Sep 2016 11:01:29 -0400 (EDT)
Received: from mail2.ihtfp.org ([127.0.0.1]) by localhost (mail2.ihtfp.org [127.0.0.1]) (amavisd-maia, port 10024) with ESMTP id 09760-02; Thu, 8 Sep 2016 11:01:25 -0400 (EDT)
Received: from securerf.ihtfp.org (unknown [IPv6:2001:470:e448:2:ea2a:eaff:fe7d:235]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client CN "mocana.ihtfp.org", Issuer "IHTFP Consulting Certification Authority" (verified OK)) by mail2.ihtfp.org (Postfix) with ESMTPS id 666EBE2054; Thu, 8 Sep 2016 11:01:25 -0400 (EDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ihtfp.com; s=default; t=1473346885; bh=rQkVtRbG6PHtgLr743NrVGxf2KOtOCS5tdfu7AUuEk0=; h=From:To:Cc:Subject:References:Date:In-Reply-To; b=UCsT17Jq58UpBFZrX7p2ppEbZyKElOiun1Ekwsa8NPmBc99Q0ehWeFe5TalQoM73b Qm2knZq3sxKlh+b4NNxlVx2HlG5N5dwesh7lirL/XbgOtnqedJHZPmGi4lnb40uwdr wjX+SsUtbpSZjMFVyK75CQx4yKAHZdbuMu7/dfJs=
Received: (from warlord@localhost) by securerf.ihtfp.org (8.15.2/8.14.8/Submit) id u88F1OfK007591; Thu, 8 Sep 2016 11:01:24 -0400
From: Derek Atkins <derek@ihtfp.com>
To: Tony Arcieri <bascule@gmail.com>
References: <m2lgzcyhxi.fsf@bos-mpeve.kendall.corp.akamai.com> <201608311948.u7VJmChl018731@rumpleteazer.rhmr.com> <CABrd9STOCbBo=g22XySRnWofHwVZkrC-ripZY38yLRZV2kQh3A@mail.gmail.com> <sjminu8vk1t.fsf@securerf.ihtfp.org> <1473221674611.89839@cs.auckland.ac.nz> <CAHOTMVKJJAOz+a0d6jej2mYpM9LiBnt65XtYVVTH6dKzN_UCxA@mail.gmail.com>
Date: Thu, 08 Sep 2016 11:01:24 -0400
In-Reply-To: <CAHOTMVKJJAOz+a0d6jej2mYpM9LiBnt65XtYVVTH6dKzN_UCxA@mail.gmail.com> (Tony Arcieri's message of "Wed, 7 Sep 2016 12:45:14 -0700")
Message-ID: <sjmzinitozf.fsf@securerf.ihtfp.org>
User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/24.5 (gnu/linux)
MIME-Version: 1.0
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable
X-Virus-Scanned: Maia Mailguard 1.0.2a
Archived-At: <https://mailarchive.ietf.org/arch/msg/cfrg/jnVS7Lv59e1Af06KJ-04JsD-_P0>
Cc: "cfrg@irtf.org" <cfrg@irtf.org>, "tls@ietf.org" <tls@ietf.org>, Peter Gutmann <pgut001@cs.auckland.ac.nz>
Subject: Re: [Cfrg] [TLS] 3DES diediedie
X-BeenThere: cfrg@irtf.org
X-Mailman-Version: 2.1.17
Precedence: list
List-Id: Crypto Forum Research Group <cfrg.irtf.org>
List-Unsubscribe: <https://www.irtf.org/mailman/options/cfrg>, <mailto:cfrg-request@irtf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/cfrg/>
List-Post: <mailto:cfrg@irtf.org>
List-Help: <mailto:cfrg-request@irtf.org?subject=help>
List-Subscribe: <https://www.irtf.org/mailman/listinfo/cfrg>, <mailto:cfrg-request@irtf.org?subject=subscribe>
X-List-Received-Date: Thu, 08 Sep 2016 15:01:36 -0000

Tony Arcieri <bascule@gmail.com> writes:

> On Tue, Sep 6, 2016 at 9:15 PM, Peter Gutmann <pgut001@cs.auckland.ac.nz>
> wrote:
>
>     When crypto hardware support is available, it's universally AES,
>     occasionally
>     SHA-1 and/or DES, and very rarely RSA and/or DH and/or ECDSA 
>
> EMV chip cards support RSA digital signatures. Granted earlier EMV cards used
> ridiculously small key lengths (i.e. 320-bits), but they have been gradually
> ratcheted up to e.g. 768 or 1024-bits.

So they are finally up to 80-bit security?  Woohoo!
That makes me feel so safe.

> These cards number in the billions (10s of billions?) and the chips are priced
> in the penny range.
>
> I don't think it's impractical to ship hardware accelerated asymmetric crypto
> primitives on chips that meet the specifications you're describing. The
> payments industry has definitely shown it's possible.

Payments are a very poor example..  Several seconds per transaction?
That's not usable performance.  Look at all the pushback from consumers
that have been happening since the changeover to chip cards in the US
this past year.

> Tony Arcieri

-derek
-- 
       Derek Atkins                 617-623-3745
       derek@ihtfp.com             www.ihtfp.com
       Computer and Internet Security Consultant

v2.23.0 | Report a Bug | By Email