Re: [TLS] I-D Action: draft-ietf-tls-negotiated-ff-dhe-02.txt

[Stephen Checkoway <[e-mail]>]

The arguments against including small groups seem clear:

1. New things shouldn't be using small groups.
2. Old things that can't/won't be updated _won't be updated_ no matter what a new RFC says.
3. This doesn't prohibit arbitrary groups so anything that needs to keep using small groups can keep using small groups.

The argument for including small groups seems to be (and correct me if I've missed something):

Old things can't/won't be updated except for (maybe) small tweaks and this extension is a small tweak that would enable these devices to keep doing what they're already doing: using small groups.

Particularly in light of 3, I don't find the argument for including them compelling.

S

On Oct 24, 2014, at 5:05 PM, Alyssa Rowan <[e-mail]> wrote:

> Signed PGP part
> On 24/10/2014 15:55, Peter Gutmann wrote:
> 
> > Re-doing the crypto to implement and support ECC may happen in five
> >  to ten years, if there's enough code space in the flash.
> 
> So, you want to use 768-bit groups… for five to ten years… yeah, I'm
> not too comfortable with that.
> 
> >> No, it's blessing them even to list them. People will probably
> >> implement what we specify.
> > So put in a note saying that use isn't recommended.
> 
> …or, you could not put it in.
> 
> Intentionally specifying something new, in a security-oriented RFC,
> that by the way you absolutely shouldn't use because it's insecure,
> seems a bit reckless to me.
> 
> > ("it works, don't touch it any more").
> 
> I think we really ought to be getting rid of skeletons in the closet,
> not adding new ones - despite Hallowe'en being next week, and that
> phrase being appropriately spine-chilling! ;)
> 
> (BTW: Lost, embedded devices; too small to use a 2048-bit group for…
> some reason? RAM?; yet negotiate (768|1024|1536) DHE…
> 
> …wild guess here: RSA key signing this exchange is totally
> minty-fresh? …and actually checked? With something that isn't MD5? And
> the DHE keys aren't generated with 2 bits of entropy and a potato
> because the $2.50 intern lunch budget didn't cover an RNG? <g>)
> 
> >> 768 and 1024 are crackable today by any reasonably well-funded
> >> adversary with access to a chip fab, as you well know;
> > ... who probably won't be using that capability to attack a power
> > meter, or a flow monitor
> 
> …or a centrifuge? ¬_¬
> 
> SCADA security - or lack thereof - is a very big problem. I don't
> agree that specifying groups for future use that we _know_ are too
> small, helps do anything but make it worse.
> 
> --
> /akr
> 
> 
> _______________________________________________
> TLS mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/tls

-- 
Stephen Checkoway