[TLS] Re: Composite ML-DSA

[Simon Josefsson <[e-mail]>]

Peter Gutmann <pgut001=[e-mail]> writes:

> If your protocol allows a man-in-the-middle attack, it's a real
> pearl-clutcher.

TLS 1.3 deprecated unauthenticated uses of TLS.  Thus I believe there is
wide support for the notion that server authentication provides value,
even to the point of deprecating alternatives.

> Hint: Some years ago many major sites (Apple, Amazon, eBay, HP, PayPal,
> Twitter, and many more) were using keys as weak as 384 bits for DKIM signing.
> One third of all DKIM-using domains were using keys so weak a dedicated
> individual could have broken them.  Despite the fact that the protocol, or at
> least the way it was used, allowed a REALLY bad attack, no-one did.

t-systems.nl uses a 384-bit RSA DKIM key even today, and didn't consider
it a problem when reported to them.

The reason few attacks DKIM is because there is so little to gain.

If someone knows a way to do a man-in-the-middle attack between Chrome
and google.com on some common user platform, I'm sure people would be
more interested than a DKIM attack.  There is a reason google.com or
t-systems.nl doesn't use a 384-bit RSA key for HTTPS.

/Simon