Re: [saag] AD review of draft-iab-crypto-alg-agility-06

[Nico Williams <[e-mail]>]

On Mon, Jul 27, 2015 at 08:54:50PM +0100, Stephen Farrell wrote:
> 
> Hiya,
> 
> <hats-off>
> 
> On 27/07/15 20:40, Nico Williams wrote:
> > The key thing is that weak crypto must not lead to real-time exploitable
> > downgrade attacks.
> 
> I think this nicely captures a point where we can have a real
> disagreement about OS.
> 
> I would prefer if we could agree that:
> 
>    OS use of weaker crypto must not allow feasible off-line
>    deciphering of ciphertext, no matter the adversary within
>    the likely duration for which the average plaintext is
>    sensitive.

Not quite right.  How about:

   OS use of weaker crypto must not make downgrade attacks feasible on
   non-OS implementations.  In particular the Logjam attack (or variants
   of it) must be infeasible.

   [Insert suitable reference to / description of the Logjam attack.]

Because even for OS applications, really, really weak crypto is still
better than cleartext (the identity function being the weakest crypto).

The key is that offering really weak crypto at all must not compromise
non-OS users of the same protocol.

> According to the above, 1DES and export ciphers would be completely
> out of the question. And rc4 is getting really really close.

In my construction the only crypto that's off-limits is that which
permits the Logjam attack.

> <hat-back-on>
> 
> I'm not sure we'll reach rough consensus on either side of this
> argument though so we may be reduced to silence on the hard part of
> the question.

Well, look, I made a specific argument as to OS being a migration
attempt that will be harmed by spurious failures.  That needs to be
addressed.  With that addressed, if we end up on the rough side then so
be it, but that argument must be acknowledged and addressed -- it would
not be right to just ignore it.

I'd go further: even if we decide to reject this argument, it should be
acknowledged in the I-D and the rationale for rejecting it should be
included, because implementors and future researchers/engineers may
benefit from having that argument and counter-arguments easily
available.

Nico
--