Re: [saag] AD review of draft-iab-crypto-alg-agility-06

[Nico Williams <[e-mail]>]

On Mon, Jul 27, 2015 at 09:48:08PM +0100, Stephen Farrell wrote:
> Put another way, if we all agreed that rc4 can likely be routinely
> deciphered in N years and if we further agreed that there are a lot
> of plaintexts that will still be sensitive in N years, then there is
> no great difference today between sending cleartext and rc4
> ciphertext, when we consider highly capable adversaries who record
> ciphertext, and we know those exist even if we do not know quite
> how much ciphertext they record, for how long.

There is no great difference for _one_ connection.  There is a great
difference for _many_ connections.  I.e., even weak crypto makes
pervasive eavesdropping significantly more expensive.

That's not nothing.

I don't mind dropping weak crypto that [Viktor says] is insignificant
for SMTP _now_.  But the principle as stated earlier matters as a
principle.  Losing track of that principle may hurt us the next time
we want to deprecate a then-weak algorithm.

Nico
--