Re: [TLS] Comparative cipher suite strengths

[Nicolas Williams <[e-mail]>]

On Wed, Apr 22, 2009 at 12:16:32PM +0100, [e-mail] wrote:
> Thanks for all the responses. I think the following text is a better
> way of describing what I meant and why I was asking:
> 
> We have a customer that mandated that we utilize AES-256 for the
> symmetric encryption keys used on our TLS sessions, so we have
> complied, and this works fine. Looking at implementation details from
> the customer, I found that they are using static X.509v3 certificates
> (CA issued), where the public key size is only 1024 bits.

As you surmise the weak link in the chain then is the RSA key size.
There's always going to be a weak link, but there's no sense in making
the other links stronger so far out of proportion to the weakest link.

Either the customer should revise their requirement that AES-256 be used
or they should deploy larger RSA keys.  But even so, going whole hog to
15kbit key lengths is not really practical.  Therefore I'd recommend
raising the RSA key size to 2048.

> So, I would want to recommend to the customer that if they want a more
> secure TLS session, then they need to increase the RSA key sizes to
> "match" the symmetric key strength, as the overall security 'strength'
> of their TLS sessions comes down to their RSA key size [as it's lower
> comparably to AES-256].
> 
> Does this seem reasonable and make more sense than my original question?

Yes, but by my experience your customer's security policy people are not
likely to agree or will be averse to any change.  Here's how this sort
of thing goes:

SECURITY: the policy is <fill in the blank> (and "it's needed for SOX
compliance")
INTERNAL AUDIT: you're not doing what the policy requires
YOU: the policy is stupid^H^H^H^H^H^Hbroken, here's why
SECURITY: <crickets>

If you get past that you then run into other walls.  E.g., say you
convince the policy ppl that they should raise the RSA key size, but
then the business people complain that performance sucks, or that
deploying new certs will cost too much, so they ask their regulators for
a waiver -- and then you're back at square one (the policy has changed
but reality hasn't).

See also Dilbert.

Nico
--