Re: [TLS] draft-sheffer-tls-bcp: DH recommendations

[Michael Ströder <[e-mail]>]

james hughes wrote:
> 
> On Sep 19, 2013, at 2:56 AM, Peter Gutmann <[e-mail]> wrote:
> 
>> "Blumenthal, Uri - 0558 - MITLL" <[e-mail]> writes:
>>
>>> I personally think that for *ephemeral* DH even 1024 bits still is enough.
>>> And would *much* prefer having PFS now with individual session keys at
>>> somewhat greater risk, over a system that is very secure and completely
>>> useless because nobody bothered to deploy it.
>>
>> Exactly.  We don't need theoretically perfect security in ten years when we've
>> finished arguing about it and have upgraded every system on the planet to
>> support it, we just need good enough right now.  That's DH-1024, and when we
>> have that turned on everywhere we've got some breathing space to worry about
>> what to do next.
> 
> 
> "theoretically perfect security in ten years", really? You think that 1024
> is "good enough"? I do not know a single reputable source that says 1024
> bit is "secure" (outside the people on this list). Not even NIST. If you
> are going to step forward for PFS, do it right. Raise the D-H key size to
> 2048. 2048 bit is required now and will give you security for only 7 years
> (Thank you France).

I personally would prefer D-H key size 2048 bit everywhere and I don't worry
about performance. (Did you ever notice that most SSL/TLS connections are
going to ad servers?)

But the problem in the context of draft-sheffer-tls-bcp is that existing
implementations do not support D-H key size of 2048 bits. And the author(s) of
this draft take this fact to rule out DH completely and recommend EC-based
cipher suites. IMHO ECs seem to be a can of worms. I don't trust those
complicated cipher suites.

Ciao, Michael.