Re: [TLS] security levels for TLS

At Fri, 12 Oct 2007 17:42:22 -0700,
Mike wrote:
> >> Negatives:
> >>
> >>    - effort is needed to write a specification and approve it
> >>    - a server may not support the extension, so a client may
> >>      have to implement an inefficient renegotiation scheme in
> >>      addition anyway
> > 
> > - It encourages an inappropriate focus on key size. As I said already,
> >   There's a lot more to security than key size.
> 
> But key size -is- a big part of it, and you should be able to tell
> a server what key sizes you want, rather than leave it up to chance.

To sharpen the point I was trying to make earlier, once you're using
keys in the 1024-bit range, there are actually a number of other
factors which are of equivalent if not larger importance to key
size. These include:

- The quality of PRNG used to generate the key.
- Whether the key is being securely stored (e.g, in an HSM).
- When we're talking DH, whether each ephemeral is fresh, and
  the structure of the DH group.
- Which server is in use.
- Whether the server software is up to date.

The last two in particular are of vastly more importance than key
size. I have never heard of a 1024-bit RSA key being cracked, yet I'm
aware of remote vulnerabilities in every major C-based SSL
server. These vulnerabilities lead to far easier private key
extraction than factoring the modulus.

-Ekr

_______________________________________________
TLS mailing list
TLS@lists.ietf.org
https://www1.ietf.org/mailman/listinfo/tls