Re: [saag] AD review of draft-iab-crypto-alg-agility-06

[Yoav Nir <[e-mail]>]

> On Aug 25, 2015, at 7:21 PM, Stephen Farrell <[e-mail]> wrote:
> 
> 
> Viktor,
> 
> (Here we are back at this argument again:-)
> 
> On 25/08/15 17:06, Viktor Dukhovni wrote:
>> In any case, whether it is RC4 now, or some other deprecated
>> ciphersuite in the futre, with opportunistic security one needs to
>> pay more attention to what interoperates than what is unequivocally
>> strong.  The goal is as much security as can be realistically had,
>> not "all or nothing".  I like to make an analogy with vaccination,
>> we're protecting the infrastructure as a whole, rather guaranteed
>> security for a particular flow.
> 
> Do you agree though that there are at least two points in time
> involved when considering weakened or suspect ciphers?
> 
> There is the time you're discussing of when the bad algorithm
> can be turned off without damaging interop of ciphertext form
> packets.
> 
> But there is also the time after which one considers that all
> such ciphertext will in a short while be almost the same as
> plaintext for a capable attacker.

It depends on what that capable attacker is trying to do. If this adversary is attacking *your* communications, you’re right. If the adversary is attempting pervasive monitoring, this stage almost never comes. If every TCP connection today was encrypted with DES a capable attacker could decrypt any connection but not every connection. They couldn’t even decrypt 1% of all connections. So against an adversary engaging in pervasive monitoring, even single DES is significantly better than cleartext.

Yoav