Re: [TLS] security levels for TLS

At Wed, 10 Oct 2007 09:48:03 -0700,
Mike wrote:
> 
> There are two aspects to this that I see:
> 
>    1) a TLS client should be configurable such
>       that it will reject negotiated sessions
>       that don't satisfy its requirements.  The
>       configurable parameters would include the
>       minimum acceptable size for RSA and DSA
>       keys, and DH parameters (p).  This can be
>       done now without any changes to TLS, but
>       has the problem that several attempts may
>       be necessary to establish an acceptable
>       connection.

This seems like a perfectly reasonable capability for
a developer to provide, I'm not convinced that a
developer *should* provide it. In any case, it's
not an IETF issue.

>    2) a TLS client might want to tell the server
>       that if TLS_DHE_RSA_WITH_AES_128_CBC_SHA1
>       is the negotiated cipher, it will accept
>       a minimum RSA key size of X and a minimum
>       DH parameter size of Y.  If the server
>       has several sets of DH parameters (such as
>       those in RFC 3526), it would select one
>       that meets the minimum and is smallest for
>       best performance.  If the server doesn't
>       have the ability to satisfy the minimums,
>       it could return an insufficient_security
>       fatal alert.

This adds significant complexity for what's in my experience,
a non-problem. The vast majority of servers I am familiar with
have one and only one set of asymmetric keying material, so
selecting it isn't a problem. Moreover, it's simply not the
case that one can express the security of an algorithm
purely in terms of the number of bits of claimed keying
material. Examples include 3DES (112 or 168?, depends on
the attack), EC (it's not clear that all groups of the same
size are equally secure).

Absent some significant evidence that this is a problem in 
practice, I'm against the TLS WG doing anything along these
lines.

-Ekr

_______________________________________________
TLS mailing list
TLS@lists.ietf.org
https://www1.ietf.org/mailman/listinfo/tls