Re: [TLS] Deprecating more (DSA?)

[Johannes Merkle <[e-mail]>]

Watson Ladd wrote on 17.04.2014 05:24:
> Dear all,
> I support most of the removal ideas. I would like to note in
> particular that 3DES has a 64-bit block, which limits the transferable
> data to 2^32 blocks, and so as a backup to AES it is painful. (We
> would also need to fix the EtM problem with it: a lot of work that we
> don't have to do). I think DHE will fall before ECDHE, but they are
> similar enough
> 
> ECDSA is a complicated story. Yes, it makes unnecessary use of a
> random number generator during signing. It is much safer to add 32
> bytes to the secret key, hash that with the message, take that key,
> stretch to twice as long as the group order with the hash function.
> The inversion of k serves no purpose now that Schnorr's patent has
> expired. It cannot be batched.
> 
> However, it is still very secure. I would like to see more performant
> alternatives develop, but from a security perspective it's fine. FIPS
> can do it however they can, and non-FIPS people will do it the right
> way. I don't think removal is the right decision at this juncture.
> 

I second that. There are ECDSA implementations out there using sound RNG/PRNG, which are not easily modified. E.g. FIPS
certified HW devices.
-- 
Johannes