Re: [TLS] Unifying tickets and sessions

[Hubert Kario <[e-mail]>]

On Tuesday 21 October 2014 14:33:43 David Leon Gil wrote:
> On Tue, Oct 21, 2014 at 3:10 AM, Richard Fussenegger, BSc
> 
> <[e-mail]> wrote:
> > I'm [. . .] glimpsing over to the fact that the
> > cryptography community agrees that 128 bit security will be enough for the
> > next 10 to 20 years.[2]
> 
> This really isn't true. See djb's "matching AES security" at
> https://www.ietf.org/mail-archive/web/cfrg/current/msg04820.html
> 
> Summarizing: The workfactor of a multi-target attack is much lower for
> symmetric-key crypto than for attacks against asymmetric-key crypto.
> This is exactly the sort of attack that is useful for mass
> surveillance.
> 
> We need to start moving away from AES-128 now, not in 10 years.
> 
> (Note that a number of cryptographers think that 2^90 operations per
> year is feasible today; djb is lowballing the number a bit.)

That assumes that you have the space to store all those communications, most 
of which will be utter garbage for you (spdy/HTTP2.0 as a whole and HTTP1.1 
keep alive connections), then you need to have the ability to reference all 
those 2^50 keys in close to real time.

Yes, it doesn't require "hard" computation, but it does require massive 
amounts of relatively fast memory.

It's a classic memory-time tradeoff, isn't it?

And looking at current computers, time is cheaper and is getting cheaper 
faster than memory is, as it has for at least past 20 years...

-- 
Regards,
Hubert Kario