Re: [TLS] Comparative cipher suite strengths

[[e-mail]]

>On Tue 21/04/09 4:55 PM , Eric Rescorla [e-mail] sent:
>>At Tue, 21 Apr 2009 16:32:54 +0100, Carl Young wrote:
>> 
>> So, for TLS_RSA_WITH_3DES_EDE_CBC_SHA, assuming an RSA 1024 bit key-pair, 
>> would the effective strength of the connection be 80 bits or am I looking to 
>> compare apples and oranges?
>>
>> If I want to negotiate AES-256, should I really be using a 15360 bit RSA key 
>> or, again, am I looking at this in the wrong way?
>
>Well, I think that this last bit is certainly looking at it the wrong
>way. We don't know of any conditions under which AES-256 would be
>breakable and AES-128 would not be, so talking about "key strength"
>just doesn't make much sense at that level.

The "key strength" would be limited by the weakest link in the suite though wouldn't it, which, in this case, is the RSA keys? Or are you saying that the additional security of the PRF, key derivation mechanisms, and the entropy in the random data overcomes this?

I suppose what I'm trying to establish is that [hypothetically] if the technology existed to brute-force attack a 1024 bit RSA key pair in a short time-frame (say 1-2 days), would the attacker be able to recover the AES-256 keys used in the TLS session and decode the complete session, or is it more involved in that?

Thanks,

Carl