Re: [TLS] STRAW POLL: Size of the Minimum FF DHE group

[Stephen Checkoway <[e-mail]>]

On Nov 4, 2014, at 12:14 PM, Nikos Mavrogiannopoulos <[e-mail]> wrote:

> ----- Original Message -----
> [...]
>> Background: Regardless of whether you agree with what follows or not, the
>> following has been put forward as the rationale. We don’t need comments on
>> the rationale, we’re just providing it for background.
>> 
>> 1) 3DES has a 112-bit work factor and is still considered acceptable in TLS
>> 1.2 and the DLOG keying material shouldn’t be any weaker than the symmetric
>> cipher.
>> 
>> 2) There is some disagreement about the work factor for the DLOG keys - e.g.,
>> NIST says 112-bit work factor correlates to 2048-bit DLOG keys but ECRYPT-II
>> says 112-bit work factor correlates to 2432-bit DLOG keys (see references in
>> draft).
>> 
>> 3) The other point made about 2048-bit DLOG is that it’s a power of 2 and
>> there’s parity with the public key sizes.
> 
> I vote for 2432. Since we have two conflicting advices (NIST and ECRYPT), IMO
> the best is to go with the most conservative one (especially given that this
> draft is going to be fully deployed years from now).

Going with ECRYPT-II's recommendation of 2432 as it is the more conservative advice gets my vote.

-- 
Stephen Checkoway