Re: [TLS] STRAW POLL: Size of the Minimum FF DHE group

[Nikos Mavrogiannopoulos <[e-mail]>]

----- Original Message -----
[...]
> Background: Regardless of whether you agree with what follows or not, the
> following has been put forward as the rationale. We don’t need comments on
> the rationale, we’re just providing it for background.
> 
> 1) 3DES has a 112-bit work factor and is still considered acceptable in TLS
> 1.2 and the DLOG keying material shouldn’t be any weaker than the symmetric
> cipher.
> 
> 2) There is some disagreement about the work factor for the DLOG keys - e.g.,
> NIST says 112-bit work factor correlates to 2048-bit DLOG keys but ECRYPT-II
> says 112-bit work factor correlates to 2432-bit DLOG keys (see references in
> draft).
> 
> 3) The other point made about 2048-bit DLOG is that it’s a power of 2 and
> there’s parity with the public key sizes.

I vote for 2432. Since we have two conflicting advices (NIST and ECRYPT), IMO
the best is to go with the most conservative one (especially given that this
draft is going to be fully deployed years from now).

regards,
Nikos