Re: [TLS] STRAW POLL: Size of the Minimum FF DHE group

[Bodo Moeller <[e-mail]>]

Sean Turner <[e-mail]>:


> To help us reach consensus on this point, please reply to this email
> indicating whether you favor a “2048" or “2432” minimum group size.


2048.

In applications where you're concerned that a 2048-bit DH group might be
too small, you most certainly should not be using 112-bit or 128-bit
symmetric encryption keys for your connections in the first place: as soon
as there a multiple connections that an attacker may be interested in
(which must be assumed for TLS), a k-bit symmetric key won't give you
"k-bit security" in any meaningful sense anyway.

(Apparently this important issue isn't well-understood, but
see draft-ietf-tls-negotiated-ff-dhe-02's reference [ENISA] for some
discussion; or see
http://www.ietf.org/mail-archive/web/cfrg/current/msg04935.html etc.)

Conversely, if 128-bit symmetric encryption is well above your required
security level, having to use a 2432-bit group instead of a 2048-bit group
would be unreasonable overhead.

Bodo