Re: [saag] AD review of draft-iab-crypto-alg-agility-06

[Nico Williams <[e-mail]>]

On Mon, Jul 27, 2015 at 09:48:26PM +0000, Salz, Rich wrote:
> > My concern is that workfactor will be small enough in a few years that mail
> > traffic encrypted today will be essentially treatable as cleartext by the most
> > capable adversaries. While the rc4 encryption will add some cost, I'm
> > concerned that'll be too small (again, in a few years).
> 
> My timetable is shorter (two, not a few) but I agree.
> 
> The national-scale adversaries are already scooping up all traffic.

This is true, but remember that cryptanalyzing the identity function is
even easier...  The context here is OS -- don't lose that context.

Eventually between OS and DANE we should get to where we can just
require TLS for SMTP and eventually even authentication of servers.
Then indeed using stronger ciphers will matter more than in then context
of OS right now.

> I used to be highly skeptical of post-quantum crypto, but now I want
> something like whyte's PQ mixin stuff today.

Yes, sure, but one thing at a time.

Nico
--