Re: [Curdle] Looking for comments on draft-ietf-curdle-ssh-kex-sha2

[Ron Frederick <[e-mail]>]

On Aug 17, 2020, at 11:37 PM, Mark D. Baushke <[e-mail]> wrote:
> Ron wrote:
>> I’m no expert when it comes to key strength, but I would expect a
>> 2048-bit RSA key to last at least as long as 3DES, since both are
>> considered to have 112 bits of security.
> 
> MDB: Note this is in NIST SP 800-131Ar2
> 
> URL: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-131Ar2.pdf <https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-131Ar2.pdf>
> Table 1.
> 
>    Three-key TDEA Encryption Deprecated through 2023
>                              Disallowed after 2023

[Ron] Thanks for the pointer. I was familiar with an earlier version of that doc, but didn’t know there was a 2019 update. The deprecation of TDEA seems to be a special case, though, and not something which it is applying to all algorithms with 112 bits of security. For the others, it still seems to be sticking by the previous recommendation that 112 bits will be ok until 2030. For DH in particular, we don’t need to worry about the lifetime of the “protected data”, as the session keys negotiated by the SSH key exchange typically don’t last very long. The main issue for DH seems to be whether it complies with SP 800-56A or not (https://doi.org/10.6028/NIST.SP.800-56Ar3 <https://doi.org/10.6028/NIST.SP.800-56Ar3>), and I think we’re ok on that here, at least for the predefined safe primes.


> I found the article. It was in Advances in Cryptology - ASIACRYPT 2017.
> 
> Quantum Resource Estimates for Computing Elliptic Curve Discrete Logarithms
> by Martin Roetteler, Michael Naehrig, Krysta M. Svore, and Kristin Lauter
> November 2017, 24 Pages
> 
> URL: 
> 
> https://www.microsoft.com/en-us/research/wp-content/uploads/2017/09/1706.06752.pdf <https://www.microsoft.com/en-us/research/wp-content/uploads/2017/09/1706.06752.pdf>

[Ron] Thanks - I’ll check it out!
-- 
Ron Frederick
[e-mail]