Re: [TLS] draft-sheffer-tls-bcp: DH recommendations

[Nikos Mavrogiannopoulos <[e-mail]>]

On 09/21/2013 08:57 AM, james hughes wrote:

> "theoretically perfect security in ten years", really? You think that
> 1024 is "good enough"? I do not know a single reputable source that
> says 1024 bit is "secure" (outside the people on this list). Not even
> NIST. If you are going to step forward for PFS, do it right. Raise
> the D-H key size to 2048. 2048 bit is required now and will give you
> security for only 7 years (Thank you France).
[...]
> Why does the burden of proof seem to be so high on the cryptographers
> to prove that an algorithm (or key size) is not secure enough? Stated
> differently, why must crypto community, who knows something is, or
> will soon be, breakable have to shame the standards bodies into
> reasonable action with a pie in the face  [for the non-english
> speakers, for a definition of "pie in the face" see
> http://en.wikipedia.org/wiki/Pieing]?

I couldn't agree more. The fact that 1024-bits is the only option in
some implementation that doesn't make it the best practice. It was the
best practice 13 years ago.

What would be reasonable would be to keep 2048 as the recommended value
(so the implementations with issues have an incentive to fix) and
additionally mention the issues that some implementations have, and
recommend that if short term protection is sufficient 1024-bit DH groups
offer better compatibility. Mentioning anything else than that will
mislead non-crypto experts (all key length studies list 1024-bit DH
groups as suitable for short-term data protection, nothing more).

regards,
Nikos