Re: [TLS] Another IRINA bug in TLS

[Jeffrey Walton <[e-mail]>]

On Thu, May 21, 2015 at 4:45 PM, Dan Brown <[e-mail]> wrote:
>> -----Original Message-----
>> From: Watson Ladd [mailto:[e-mail]]
>>
>> On Thu, May 21, 2015 at 12:51 PM, Dan Brown <[e-mail]>
>> wrote:
>> > In the Imperfect Forward Secrecy paper, Section 5 Recommendations, the
>> > medium term recommendation to avoid fixed-prime DHE groups seems to
>> > conflict with the current direction TLS is taking towards named only
>> > groups.
>>
>> Is that *really* what the recommendation says? It's true that using the same
>> group repeatedly enables an attacker who does an L(1/3) calculation to
>> quickly
>> compute all discrete logarithms together. But instead of making
>> countermeasures to this, it's far easier to ensure that the price this
>> precomputation is large, by using larger groups.
>
> [DB] That's how I read their medium term recommendation.  I agree with them,
> and you, that larger groups should be the first defense (they call it short
> term).  I guess that by "medium term", they mean to apply it in addition to
> the short term, perhaps at a later date.  I think such countermeasures should
> be optional.

I think the authors felt the same. But in Section 4 of the paper, they said:

    In this section we address the following
    question: how secure is Diffie-Hellman in broader practice,
    as used in other protocols that do not suffer from downgrade,
    and when applied with stronger groups?

    To answer this question we must first examine how the
    number field sieve for discrete log scales to 768- and 1024-bit...

    Unfortunately, our measurements also indicate that it
    may be very difficult to sunset the use of fixed 1024-bit Diffie-
    Hellman groups that have long been embedded in standards
    and implementations.

I think they are politely saying standard groups should do away with
anything at 1024-bits or below.