Re: [saag] AD review of draft-iab-crypto-alg-agility-06

[Stephen Farrell <[e-mail]>]

I'm not trying to argue against you or Nico but just to be
clear...

On 27/07/15 21:31, Viktor Dukhovni wrote:
> I expect that by the time an algorithm supports practical
> general-purpose offline plaintext recovery (which is a stronger
> attack than the RC4 recovery of fixed plaintexts at fixed message
> offsets sent millions of times) it will generally no longer be in
> wide use, or will be in the process of rapid retirement.

IMO, rc4 should already be consider unacceptable as I reckon
the probability of a full break whilst many ciphertexts are
still sensitive is too high. I still think that even given the
situation with email.

One difference between our positions is that I'm considering
the duration for which many plaintexts are likely still sensitive
and not only immediate decryption today (which is how I read you
and Nico's text).

Put another way, if we all agreed that rc4 can likely be routinely
deciphered in N years and if we further agreed that there are a lot
of plaintexts that will still be sensitive in N years, then there is
no great difference today between sending cleartext and rc4
ciphertext, when we consider highly capable adversaries who record
ciphertext, and we know those exist even if we do not know quite
how much ciphertext they record, for how long.

But I do recognise that there's enough scope in all of the above
for genuine differences of opinion and there is no certainty in
any of it, so we may have to live without consensus at that level
of detail.

S.