Re: [TLS] STRAW POLL: Size of the Minimum FF DHE group

[Hubert Kario <[e-mail]>]

On Tuesday 04 November 2014 12:49:21 Sean Turner wrote:
> Hi!
> 
> At the TLS Interim meeting in Paris, the WG discussed the FF DHE draft
> (https://datatracker.ietf.org/doc/draft-ietf-tls-negotiated-ff-dhe/).  The
> chairs would like to poll the WG on one of the issues in the draft namely
> the size of the minimum group.
> 
> The draft currently includes a minimum group size of 2432 but the WG also
> discussed 2048.  Groups smaller than 2048 were discounted for a standards
> track document as too weak for use but might be documented in a separate
> “historic” draft.  To help us reach consensus on this point, please reply
> to this email indicating whether you favor a “2048" or “2432” minimum group
> size.  Note we’re also looking to specify the smallest number of options
> for groups as is acceptable - i.e., we’re not looking at specifying both
> 2048 and 2432.

2048

This is of issue only to legacy applications that don't implement ECC, so 
higher security margin is of limited importance.
That's a work factor difference of around 10 bits, that's rather close to the 
difference between 3DES and AES128...

implementations of "round" numbers are much more likely to be optimised for 
higher performance in currently deployed software

It matches currently deployed base (around 4% of TLS-enabled Alexa top 1 
million servers use 2048 bit DH, while the ones that use any size between 2048 
and 3072 can be counted on one hand)

I don't know if there are HSMs that are used for DH key exchange, but of ones 
that I used, all supported only very specific RSA key sizes.

-- 
Regards,
Hubert Kario