Re: [TLS] Comparative cipher suite strengths

[Eric Rescorla <[e-mail]>]

At Tue, 21 Apr 2009 17:03:02 +0100,
[e-mail] wrote:
> 
> 
> 
> >On Tue 21/04/09 4:55 PM , Eric Rescorla [e-mail] sent:
> >>At Tue, 21 Apr 2009 16:32:54 +0100, Carl Young wrote:
> >> 
> >> So, for TLS_RSA_WITH_3DES_EDE_CBC_SHA, assuming an RSA 1024 bit key-pair, 
> >> would the effective strength of the connection be 80 bits or am I looking to 
> >> compare apples and oranges?
> >>
> >> If I want to negotiate AES-256, should I really be using a 15360 bit RSA key 
> >> or, again, am I looking at this in the wrong way?
> >
> >Well, I think that this last bit is certainly looking at it the wrong
> >way. We don't know of any conditions under which AES-256 would be
> >breakable and AES-128 would not be, so talking about "key strength"
> >just doesn't make much sense at that level.
> 
> The "key strength" would be limited by the weakest link in the suite
> though wouldn't it, which, in this case, is the RSA keys? Or are you
> saying that the additional security of the PRF, key derivation
> mechanisms, and the entropy in the random data overcomes this?

No, I'm saying that talking about trying to match anything to 
AES-256 doesn't make sense. We don't know of any situation in
which even AES-128 can be attacked.


> I suppose what I'm trying to establish is that [hypothetically] if
> the technology existed to brute-force attack a 1024 bit RSA key pair
> in a short time-frame (say 1-2 days), would the attacker be able to
> recover the AES-256 keys used in the TLS session and decode the
> complete session, or is it more involved in that?

If you're using static RSA (i.e., not DHE), then recovery of the RSA private
key suffices to recover the traffic keys.

-Ekr