Re: [TLS] Comparative cipher suite strengths

["Steven M. Bellovin" <[e-mail]>]

On Wed, 22 Apr 2009 07:14:11 -0700
Eric Rescorla <[e-mail]> wrote:

> > Second, 1024-bit RSA is a much weaker link than 128-bit AES *today*
> > -- they should switch to 2048- or 3072-bit RSA even if they stick
> > with 128-bit AES.
> 
> This I only sort of agree with: symmetric algorithms come in
> relatively rough granularity. If I was happy with 80 bits of
> security (which is apparently what NIST claims for RSA-1024,
> though I've also heard 72), then there's no good reason
> to make my PK much slower just b/c NIST has declined to
> give me an 80-bit algorithm.
> 
Assuming, of course, that people realized how weak 1024-bit RSA is,
you're right.  Did people realize that?  *Do* people realize it?  When
I look at the number of CA certs in my browser that use 1024-bit keys,
I worry...

		--Steve Bellovin, http://www.cs.columbia.edu/~smb