Re: [CFRG] NSA vs. hybrid

[Dan Brown <[e-mail]>]

> -----Original Message-----
> From: Blumenthal, Uri - 0553 - MITLL
> Sent: Saturday, December 4, 2021 8:45 PM
> ...
> My point is: we "should NOT have layered..." then, and we did not - as
> evidenced by pretty much all of the current IETF and proprietary (that I'm
> aware of) protocols.
> ...
> People who designed IPsec and TLS (presumably as smart and educated as
> we are) understood the concept of combining different algorithms as well as
> we do (it's hard not to, given its age).
> ...
> The common sense prevailed back then, and IMHO it would be better if it
> prevails now.

Not offering hybrid, say NTRU & ECC, in the past put us in this pickle now of 
the quantum computer attack risk.
Especially, all the forward secrecy obtained in the past from (EC)DHE is now 
in jeopardy (even for bug-free implementations).
Arguably, it was a smaller bug than others (using http not https, and 
non-forward-secure key exchange (RSA)).
Certainly, there are applications where the gains from hybrid are outweighed 
by the cost, but also applications where hybrid is worthwhile.
Hybrid ought to be option, or IETF WGs should use a cost-benefit analysis per 
application, the CFRG could help there.
(Generally, let's learn from our mistakes. Besides, aren't some users 
naturally inclined to expect the Internet to maximally secure their data? ;)

----------------------------------------------------------------------
This transmission (including any attachments) may contain confidential information, privileged material (including material protected by the solicitor-client or other applicable privileges), or constitute non-public information. Any use of this information by anyone other than the intended recipient is prohibited. If you have received this transmission in error, please immediately reply to the sender and delete this information from your system. Use, dissemination, distribution, or reproduction of this transmission by unintended recipients is not authorized and may be unlawful.