Re: [saag] AD review of draft-iab-crypto-alg-agility-06

[Stephen Farrell <[e-mail]>]

On 27/07/15 22:29, Nico Williams wrote:
> On Mon, Jul 27, 2015 at 10:16:09PM +0100, Stephen Farrell wrote:
>> On 27/07/15 22:06, Nico Williams wrote:
>>> There is no great difference for _one_ connection.  There is a great
>>> difference for _many_ connections.  I.e., even weak crypto makes
>>> pervasive eavesdropping significantly more expensive.
>>
>> Well, I think there's still room for validly reaching different
>> conclusions about something like rc4 when we consider the various
>> parameters. (None of which we can really measure.)
> 
> Really?  The workfactor to cryptanalyze one RC4 session is so close to
> 2^0 that it wouldn't make a difference even to a pervasive monitor?

My concern is that workfactor will be small enough in a few
years that mail traffic encrypted today will be essentially
treatable as cleartext by the most capable adversaries. While
the rc4 encryption will add some cost, I'm concerned that'll
be too small (again, in a few years).

>> Of course I fully agree with the OS approach, but I think we ought
>> recognise this wrinkle - there are going to be cases where it's
>> quite hard to do the evaluation of how to apply the OS design
>> pattern. 1DES is easy everywhere now, but rc4 for email is not
>> yet easy.
> 
> The principle is simple and stated earlier.  Again: don't enable a
> Logjam attack, and otherwise allow any weak crypto that doesn't cause a
> real-time downgrade attack on clients that could do better.  I.e., it's
> all about the handkshake's security, not the application record security
> (again, because the application would happily use cleartext).
> 
> (One counter-argument might be that it's difficult to analyze what
> configurations lead to Logjam attacks, therefore better be safe than
> sorry.)

I don't disagree with you that OS ought not enable logjam.

Cheers,
S.


> 
> Nico
>