Re: [Cfrg] how can CFRG improve cryptography in the Internet?

[Tom Ritter <[e-mail]>]

If I look at where we are now (well, I look at the bad parts of it) -
and  I look back at how we could have avoided being in the bad shapes
we are, the following comes to mind.


Small-Key RSA has taken too long to deprecate. RSA512, RSA1024.
RSA1024 is going to be used in some applications (payment devices) for
the next several years.  What would accelerate their deprecation? I've
spoken to numerous folks, and while they're all quite familiar with
the GNFS, no one is willing to go record with estimates. Perhaps the
CRFG could estimate computation needs, and costs for factoring RSA
1024 and 2048, and reevaluate it every so often. There's a difference
bewteen "The NSA can pobably factor RSA1024" and "This group of
cryptographers think we can factor it if we have $2 Million".
(Especially if someone has $2M and wants to have a go at it.)


SSL Devices have caused extraordinary upgrade pains. 0-Byte Record
Sizes, Version Intolerance, Suite & Extension Intolerance. Rigorous
test cases for these may have prevented these.  At the very least, we
wouldn't _still_ be generally ignorant about what vendors and firmware
versions are intolerant. Public pressure could help get these resolved
sooner.


We _still_ don't have a general purpose, largely complete SSL
certificate deployment for testing certificate validation. And lord
knows we have enough incorrect certificate validators.


We focus on content confidentiality. Maybe we don't care about sender
or receiver anonymity. (I do, a lot of folks do, but maybe this group
doesn't.) But if we do, we could work on that.


Similarly, there are very few designs (one?) for mutually distrusting
centrally managed architectures. In Certificate Transparency, you have
N logs all run independently asserting their view of things. What if
you had N logs talking to each other and voting to assert one
consensus document?


How about remote attestation of servers so we can assert they are
running the software stack (and web application) they purport to be?


Just some thoughts.
-tom