Re: [TLS] I-D Action: draft-ietf-tls-negotiated-ff-dhe-02.txt

[Peter Gutmann <[e-mail]>]

Alyssa Rowan <[e-mail]> writes:

>>Shorter groups are still required for embedded devices.
>
>With respect, no, they aren't. 256-bit ECDHE is --> that way. Don't use 1024-
>bit DHE; use 256-bit ECDHE. More security, more speed, less size;

... and the need to implement an entirely new type of crypto on a constrained
device with a ten-year product cycle for which the crypto development budget,
now that it's already been deployed for several years, is $2.50.  Revving the
firmware on new products to support a new TLS extension for EDH indication
will probably happen at some point.  Re-doing the crypto to implement and
support ECC may happen in five to ten years, if there's enough code space in
the flash.

>No, it's blessing them even to list them. People will probably implement what
>we specify.

So put in a note saying that use isn't recommended.  This isn't a bunch of
Windows PCs with automatic update turned on, its unknown millions of embedded
devices whose firmware is updated when the device falls apart and gets
replaced, and for which you may get away with a small tweak from time to time
but can't do any significant re-engineering once it's type-approved ("it
works, don't touch it any more").

>Technology marches on, I'm afraid; key sizes need to march on too. 768 and
>1024 are crackable today by any reasonably well-funded adversary with access
>to a chip fab, as you well know; 

... who probably won't be using that capability to attack a power meter, or a
flow monitor.  This isn't protecting nuclear weapons launch facilities, it's
for remote monitoring of fluid flows, or power metering, or a million other
SCADA applications that merely need better-than-nothing security.  Being able
to say "only use this DH group" is an improvement on current practice in which
anything is accepted.

>Keep the groups to >= 2048-bit, please.

So you're producing an RFC which will automatically be ignored, in fact which
will *have* to be ignored, by a significant market segment, and they'll stay
with their existing unverified DH.  The RFC will then have completely failed
to achieve what it's intended to achieve.

Peter.