Re: [perpass] TLS/SSL Perfect Forward Secrecy and Key Rotation

[Stephen Farrell <[e-mail]>]

Hiya,

On the non-PFS topic:

On 09/03/2013 01:11 PM, Yakov Shafranovich wrote:
> The CA/browser forum has begun some steps in this direction by
> lowering validity of SSL server certificates to 18 months. Is there a
> place for a discussion on recommending a lower time period for key
> rotation with the ensuing implications for those who do not want/can
> not use PFS?

This list is a fine place for discussing that if you
think that a shorter RSA key rollover duty cycle would
impact on pervasive monitoring. I'm not clear as to
how it would though. Have you some scenario in mind?

There are however plenty of other good reasons for
rotating RSA keys more frequently. For the web, I guess
the wpkops wg [1] would be a good place to discuss
that, but that list has been quiet recently. And that
doesn't cover other uses of TLS either, so discussing
it here is fine for now. If we start to approach some
conclusion then we can find the right venue then.

S.

[1] http://tools.ietf.org/wg/wpkops