Re: [TLS] Unifying tickets and sessions

[Ryan Carboni <[e-mail]>]

From: "Richard Fussenegger, BSc"

> [*] Better would be 'from all ciphers in use' otherwise one ends up with
> a (insert ridiculous high value here) bit key while only using 128 bit
> ciphers in the configuration. Dropping the key if a new stronger
> configuration is loaded seems like a good idea to me at this point. I'm
> looking at this from a performance perspective and glimpsing over to the
> fact that the cryptography community agrees that 128 bit security will
> be enough for the next 10 to 20 years.[2] I really can't tell if this
> would be problematic from an implementation point of view. I think that
> single hosts won't have a problem here and I guess that it wouldn't be
> for clusters as well. The cluster configuration should be in sync but it
> could become a problem if one node has a differing configuration (for
> whatever reason). What opinion/insights do you have on this?


 Quantum computers are reaching 512-qubits now.
http://www.bbc.com/news/science-environment-27632140

Quantum cryptography would result in key-sizes effectively being halved,
and in 15 to 40 years a quantum computer could potentially be built by a
nationstate to enhance known cryptographic attacks and reduce keyspaces
substantially.

It's unlikely though that the NSA will devote quantum computing to breaking
the encryption of cat videos.

I suggest an advisory that for unauthenticated encryption, 128-bits are
used, and for authenticated encryption 256-bits or more are used. The only
issue is that browsers tell you the whole page is encrypted the same way
even though elements of the page use different sorts of encryption than the
body of the page.