[TLS] Re: Composite ML-DSA

[Peter Gutmann <[e-mail]>]

Simon Josefsson writes:

>TLS 1.3 deprecated unauthenticated uses of TLS.

Well, sort of.  I don't think anyone except a few oddball niche users ever
used anon-DH even in pre-1.3 and a lot of crypto libraries never even
implemented it so it's physically impossible to use even if you wanted to,
meaning it was essentially deprecated from day one.  On the other hand since
public CAs will happily sell their certs to the Russian mafia and indeed
anyone else whose credit card payment clears, getting an "authenticated"
connection to someone's phishing site doesn't add much value.  So 1.3
deprecated TLS without certificates but not necessarily unauthenticated TLS,
depending on how philosophical you want to get about the definition of
"authenticated".

(Having said that, if you're running your own PKI and can make sure that only
the sites you allow can play then you're fine, but you also don't need TLS 1.3
for that).

>t-systems.nl uses a 384-bit RSA DKIM key even today, and didn't consider it a
>problem when reported to them.

I can understand that, the "some years ago" was over 15 years ago and if there
have been zero attacks in that time then it's good enough.

>The reason few attacks DKIM is because there is so little to gain.

Yup.  It's not protecting anything of value, or more specifically every other
attack is quicker, easier, and cheaper, so a keep-out sign is all you need,
and it means you're not burning a lot of CPU cycles doing unnecessary crypto.

Peter.