Re: [TLS] security levels for TLS

On Monday 08 October 2007, Eric Rescorla wrote:

> I think this is something that the TLS WG should avoid getting involved
> in.
I do agree that there is a lot of complexity in this issue, but the TLS WG is 
the only WG that could do this at least for TLS.

> 1. It's not really possible to come up with a single figure of merit
>    in an uncontroversial way. To take the simplest possible case, what
>    security level should we assign to TLS_RSA_WITH_NULL_SHA1 when the
>    key is 1024 bits? What's the security level of TLS_RSA_DHE_*
>    when the RSA key is 1024 bits and the DH key is 512? How about
>    the other way around?

This cannot be 100% objective by definition, but it can be based on a rational 
process. Of course the security level of those cryptosystems should be 
calculated using the weakest of the used algorithms.

I've thought about that while reading "Selecting cryptographic key sizes" 
(available at http://www.win.tue.nl/~klenstra/key.pdf)
Which gives an answer to your questions above. 

> 2. These numbers change over time as attacks get better. Unfortunately,
>    those changes aren't straightforward. For instance, it's not
>    really that easy to assess the security of HMAC-MD5 right now,
>    especially if the question you're interested in asking is how
>    secure it will be in a year (and the horizon you'd need to be
>    thinking about is more like 5 years).

I'm not talking about assessing individual algorithms, but rather give an 
estimation of security based on objective facts as the key size etc. Of 
course one cannot give precise security levels. 

> 3. It seems likely that once you get past a fairly modest algorithm
>    strength (40 bits? 64 bits?) the dominant security predictor
>    about a given system is implementation quality (remotely exploitable
>    vulns, RNG quality, ...), not algorithm strength. I don't know how
>    to assess that.

Indeed, but having at least an estimation of security based on some objective 
factor I think it is a good step forward. 

regards,
Nikos

_______________________________________________
TLS mailing list
TLS@lists.ietf.org
https://www1.ietf.org/mailman/listinfo/tls