Re: [saag] AD review of draft-iab-crypto-alg-agility-06

["Paterson, Kenny" <[e-mail]>]

Hi

On 25/08/2015 23:17, "saag on behalf of Stephen Farrell"
<[e-mail] on behalf of [e-mail]> wrote:

>Mostly fair point, though one might speculate as to whether RC4
>may end up easier than single DES. (Actually, do we have any good
>information about that? I guess there aren't many publications on
>the relative weaknesses of weak ciphers.)

This is something I can say a bit about.

Let's take TLS with DES and RC4.

To break a DES-protected connection aqap, you'd use an exhaustive key
search, needing a couple of known plaintext/ciphertext blocks (not a
problem for most application protocols running over TLS). Cost: a few
thousand dollars for the FPGAs; time: depends on budget of course, but
embarrassingly parallelisable. You've then got the key and can decrypt the
whole TLS connection.

To break RC4 in TLS, with the current public state of the art [1,2], you'd
somehow need to gather 2^26 - 2^30 encryptions of the same plaintext. That
can be done in some circumstances, e.g. malicious javascript running the
browser, with the target being HTTP cookie, but it's a bit of a stretch.
What you get back is that (short) plaintext, rather than the key.

So with the *current* state of the art, the attack requirements and attack
results are quite different. Despite the strict incomparability, I think
it's reasonable to say that DES is currently *much* less secure than RC4
in the TLS context.

What we don't know is how the attacks will evolve in future.

My guess is that the DES attack will not get any better in an interesting
way (that is, save for falling costs of hardware). DES is a good block
cipher with too small a key (and too small a block).

And it feels to me that, for RC4, the currently known public techniques
are starting to run out of steam. Maybe someone will come up with some
fresh ideas. Meanwhile, we don't really know the capabilities of
government agencies against RC4.

Cheers,

Kenny  

[1] http://www.isg.rhul.ac.uk/tls/RC4mustdie.html
[2] https://www.rc4nomore.com/