Re: [cgasec] To your health, and a comment on strength

[Christian Huitema <[e-mail]>]

> The situation where this is insufficient is where teh product of lifetime of addresses
> and resources available to an attacker exceeds some comfortable security margin.
> For example, if you have an attacker with 2**20 machines available and want your address 
> to last for 2**40 times as long as it takes to generate an address, CGA security would probably 
> be inadequate.  Similarly, if you have an attacker who has 2**40 resources and you are hoping 
> to have addresses last for 2**20 times as long as it takes to generate an address, then CGAs 
> would be inadequate. I think it is important to understand this limitation, but I also believe
> for many situations this is not a significant concern.

I believe that's a common problem for any scheme that derives identifiers from a public key. Such identifiers end up with a limited life time for a variety of reasons. The key or the hash may end up being too short, and there are downsides to making them arbitrarily long. The algorithms used in keying or hashing may be broken. The key itself may be compromised. Any system design has to account for a relatively short life of the identifiers.

-- Christian Huitema