Re: [TLS] DHE key derivation

[Yoav Nir <[e-mail]>]

On Sep 28, 2013, at 12:00 AM, Yaron Sheffer <[e-mail]> wrote:
> 
> Hi Hanno,
> 
> Just a few weeks ago we as a community thought the server's private key was generally secure.

Did we? Private keys are just files on a web server. Sometimes they leak ([1])

> Now the entire community seems to assume the private key is easy to steal.

Easy or hard depends on the practices of the web server administrators. I personally (and maybe others feel the same) think it's easier than factoring a 2048-bit number (or even factoring a 1024-bit number, or calculating a discrete logarithm in a 1024-bit MODP group). I understand it's problematic comparing unlike things, like what's easier: peace in the middle east or a manned flight to Mars? But when assessing risks to your website, you do have to figure out where to invest your resources.

> Practically, most private keys will probably not be stolen. OTOH the NSA (and also much smaller organizations) will have a pile of DH-1024 encrypted traffic for years to come just waiting for compute power to enable decryption en masse.

The longer they wait, the less valuable decrypting them becomes. And storing that pile costs them. Also, what do you mean by "en masse". If the entire traffic on the Internet was encrypted with DES (broken by civilians over 18 years ago), could the NSA afford to decrypt it all today?

> I'm sure you're not seriously suggesting that if I have a 3072-bit RSA cert, but my crypto library can only do 2048-bit DH, then I should never do DHE, and instead fall back to simple RSA, are you? Looking forward, there will always be mismatches and we should prefer the best possible TLS "mix", rather than enforce an idealistic policy.

That I agree with, but rather than optimizing mixes, I prefer to think of it as a minimum level for each primitive, and mandating at least that. An RSA ciphersuite has zero bits for PFS. Obviously, 1024-bit DH is better than zero bits (80 bits according to NIST estimates). If for various legal, commercial and BC reasons we can't mandate the 112 bits of 2048-bit DH or the 128 bits of ECDHE with the P-256 or equivalent brainpool curve or some other curve, then we should set the minimum level for now at 1024-bit DHE.

Yoav

[1] http://www.net-security.org/secworld.php?id=11144