Re: [TLS] draft-sheffer-tls-bcp: DH recommendations

["Blumenthal, Uri - 0558 - MITLL" <[e-mail]>]

From:  james hughes <[e-mail]>
> On Sep 18, 2013, at 10:34 AM, "Blumenthal, Uri - 0558 - MITLL"
> <[e-mail]> wrote:
>> If you think that in 5 years 1024-bit DH will be trivially crackable - I'd
>> like to see some evidence to support it.
> There is a different between "trivially crackable" and routinely exploitable.
> In 5 years this will be routinely exploitable.

If you mean "exploitable in bulk", then I'd buy your argument.  (Though
we've no idea what may happen in 5 years.)

> It seems to me that the standards process does not need NSA to subvert the
> process, the standards people seem to be doing this fine by themselves.
> Anyway, speaking as someone working in this field (more factoring than
> discreet log) the professional recommendation is 2048.

Recommendation noted. I almost remember myself many years ago trying to
convince SNMP WG that HMAC is a better choice than just keyed hash, and
SHA-1 should replace MD5 as "MUST". The arguments against it were "it would
hurt performance too badly".

> I am not baiting here, but the argument that 2048 is "too much" given that a
> PC can do a complete authenticated PFS key exchange in 3ms of CPU time seems
> "interesting". 

As I said, if the exchange takes 3 seconds on my PC (or on my smartphone :)
I'm OK with it. The complaints are likely to come from the server folks. You
can guess why.