From: Peter Gutmann <pgut001@cs.auckland.ac.nz>
To: "<tls@ietf.org>" <tls@ietf.org>
Thread-Topic: [TLS] Do we need DH?
Thread-Index: AdAj6fNGG3O9pH7CSo6QkGgH8wnwBg==
Date: Tue, 30 Dec 2014 04:34:50 +0000
Message-ID: <9A043F3CF02CD34C8E74AC1594475C73AAF4C7B5@uxcn10-tdc05.UoA.auckland.ac.nz>
Accept-Language: en-NZ, en-GB, en-US
Content-Language: en-NZ
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
Archived-At: http://mailarchive.ietf.org/arch/msg/tls/DjxDRoaC8bEBvcL5k4ktt_c8vLQ
Subject: Re: [TLS] Do we need DH?
Precedence: list

Watson Ladd <watsonbladd@gmail.com> writes:=0A=
=0A=
>I invite you to consider the following interesting sources=0A=
>=0A=
>http://www.spiegel.de/media/media-35511.pdf=0A=
>http://www.spiegel.de/media/media-35510.pdf=0A=
>=0A=
>DH is also being attacked by PHOENIX: I can wild mass guess that this is=
=0A=
>batch FFS: I don't know if this has been researched extensively, and even=
=0A=
>batch NFS has only an asymptotic analysis.=0A=
=0A=
Where did you see this?  All I saw was a note (in 35511) that "EDH key=0A=
exchange not exploitable by the 'easy' way" (I assume 'easy' is "grab the=
=0A=
private key", since that's what's referred to for RSA in the line above).  =
The=0A=
only PHOENIX reference was "pushing new moduli for testing against publicly=
=0A=
known weaknesses", which could mean anything ("we're checking whether=0A=
anything's vulnerable to the small-subgroup attack circa 1997, so far we=0A=
haven't found anything").  So if anything it's a ringing endorsement of EDH=
.=0A=
=0A=
In any case I doubt it's FFS (or any other cryptanalytic technique), given=
=0A=
that the rest of the documents talk about using implants, stealing config=
=0A=
files with static keys, and similar techniques.  That's the cryptographers=
=0A=
fallacy, "The NSA can attack TLS, they must have some amazing new=0A=
cryptanalytic technique that we don't know about".  No, they just lifted th=
e=0A=
static keys from the config file (c.f. the XKCD "hit him with this $5 wrenc=
h=0A=
until he tells us the password" approach).=0A=
=0A=
I also note that 35511 seems to be a case of rampant over-classification,=
=0A=
there's nothing in there that's remotely sensitive or novel, it's just an S=
SL=0A=
101 talk.  35510 is barely better, I've seen more detailed data on public=
=0A=
security blogs.=0A=
=0A=
Further, interesting to note from 35521 that GCHQ (via FLYING PIG) identifi=
ed=0A=
the Iranian government using Diginotar certs to target their own citizens.=
=0A=
=0A=
Peter.=