Re: [TLS] Do we need DH?

[Peter Gutmann <[e-mail]>]

Watson Ladd <[e-mail]> writes:

>I invite you to consider the following interesting sources
>
>http://www.spiegel.de/media/media-35511.pdf
>http://www.spiegel.de/media/media-35510.pdf
>
>DH is also being attacked by PHOENIX: I can wild mass guess that this is
>batch FFS: I don't know if this has been researched extensively, and even
>batch NFS has only an asymptotic analysis.

Where did you see this?  All I saw was a note (in 35511) that "EDH key
exchange not exploitable by the 'easy' way" (I assume 'easy' is "grab the
private key", since that's what's referred to for RSA in the line above).  The
only PHOENIX reference was "pushing new moduli for testing against publicly
known weaknesses", which could mean anything ("we're checking whether
anything's vulnerable to the small-subgroup attack circa 1997, so far we
haven't found anything").  So if anything it's a ringing endorsement of EDH.

In any case I doubt it's FFS (or any other cryptanalytic technique), given
that the rest of the documents talk about using implants, stealing config
files with static keys, and similar techniques.  That's the cryptographers
fallacy, "The NSA can attack TLS, they must have some amazing new
cryptanalytic technique that we don't know about".  No, they just lifted the
static keys from the config file (c.f. the XKCD "hit him with this $5 wrench
until he tells us the password" approach).

I also note that 35511 seems to be a case of rampant over-classification,
there's nothing in there that's remotely sensitive or novel, it's just an SSL
101 talk.  35510 is barely better, I've seen more detailed data on public
security blogs.

Further, interesting to note from 35521 that GCHQ (via FLYING PIG) identified
the Iranian government using Diginotar certs to target their own citizens.

Peter.