Re: [TLS] STRAW POLL: Size of the Minimum FF DHE group

[Martin Thomson <[e-mail]>]

On 4 November 2014 11:24, Nikos Mavrogiannopoulos <[e-mail]> wrote:
> That's not a good argument. If in 4 years the 2048-bit certificates
> are broken, we can simply reissue stronger ones with no damage to past
> sessions. If the 2048-bit DH can be broken, all the past sessions could
> be read.


I'm actually not a big fan of the argument from alignment:

A strong ephemeral exchange protects session confidentiality from some
future break or brute forcing (if that's even feasible), outside of
the window where an active attack (impersonation or hijacking) based
on a break might be possible.  If keys are properly ephemeral, an
attacker only has while the session is active (or resumptions of the
session).

A strong authentication key protects a session from MitM attacks at
the time of session creation.  Authentication keys also have an
applicability window, which is limited by the expiration of the
associated certificate (plus the relevant clock skew under the
NTP-style attacks).

There's an argument to be had for stronger ephemeral keys on this basis.

In the end, I don't care particularly.  I'd like to know if anyone
making arguments for either side feels so strongly that they would
strongly object to either.  If we're just assembling preferences, then
it's hard to see a way we can reach consensus on whether number A is
better than number B.

p.s., Clearly 2^521-1 is the best number.  It's not even clear that
there is any point arguing about the minor placings.