Re: [sasl] MOGGIES Proposed Charter

[Martin Rex <[e-mail]>]

Nicolas Williams wrote:
> 
> 
> > * Specify an interface for reporting the security strength of
> >   GSS-API mechanism.
> 
> I'd word that differently:
> 
>  * Specify an interface for enforcing security strength of GSS-API mechanisms.
> 
> The reason is that "reporting the security strength" of something
> implies [to me] an absolute measure of security strength, and I don't
> think it's possible to design a good, _stable_, absolute measure of
> security strength.


I think that the comparable strength measured in "Bits of security"
as used by NIST SP800-57 section 5.6.1 should be sufficiently stable.

What changes over time is the amount of "strength" that one considers
secure.  

      fairly stable           gradually fading
        Bits of           characterisation of strength
        security                 
          <40                 ridiculously weak
          40                  extremely weak
          56                  very weak
          64                  weak
          80                  mediocre
          96                  fair
          112                 good
          128                 strong
         >128                 very strong


-Martin