Re: [saag] AD review of draft-iab-crypto-alg-agility-06

[Nico Williams <[e-mail]>]

On Mon, Jul 27, 2015 at 10:16:09PM +0100, Stephen Farrell wrote:
> On 27/07/15 22:06, Nico Williams wrote:
> > There is no great difference for _one_ connection.  There is a great
> > difference for _many_ connections.  I.e., even weak crypto makes
> > pervasive eavesdropping significantly more expensive.
> 
> Well, I think there's still room for validly reaching different
> conclusions about something like rc4 when we consider the various
> parameters. (None of which we can really measure.)

Really?  The workfactor to cryptanalyze one RC4 session is so close to
2^0 that it wouldn't make a difference even to a pervasive monitor?

> Of course I fully agree with the OS approach, but I think we ought
> recognise this wrinkle - there are going to be cases where it's
> quite hard to do the evaluation of how to apply the OS design
> pattern. 1DES is easy everywhere now, but rc4 for email is not
> yet easy.

The principle is simple and stated earlier.  Again: don't enable a
Logjam attack, and otherwise allow any weak crypto that doesn't cause a
real-time downgrade attack on clients that could do better.  I.e., it's
all about the handkshake's security, not the application record security
(again, because the application would happily use cleartext).

(One counter-argument might be that it's difficult to analyze what
configurations lead to Logjam attacks, therefore better be safe than
sorry.)

Nico
--