Re: [Uta] updated I-Ds

On Thu, Feb 13, 2014 at 10:51 AM, Peter Saint-Andre <stpeter@stpeter.im> wrote:
> Yaron, Ralph, and I have updated our respective documents as follows:
>
> 1. draft-sheffer-uta-tls-attacks is in essence what used to be Section 2 of
> draft-sheffer-tls-bcp
>
> 2. draft-sheffer-tls-bcp now focuses primarily on the recommendations
>
> 3. draft-saintandre-xmpp-tls now mostly points to draft-sheffer-tls-bcp
>
> Please review the document set and let us know how things can be improved!

Some notes: The first two drafts do not discuss certificate validation
or pinning, which are useful for browsers and special purpose apps.

The recommendation to employ 128-bit symmetric encryption is in
conflict with the substance of the DHE recommendation. The number
field sieve takes time L(1/3, 64/9). Currently a 530 bit prime can be
done effectively with 3 core years of sieving. This implies that a
1024 bit prime will take approximately 10.5 core years, and 2048 bits
15 core years. The linear algebra step is always cheaper than sieving
on custom hardware. Double check the arithmetic, but I think this is
right. By contrast an ECDLP solution over P256 would take 2^{128}
operations, which with a billion computers doing a trillion operations
a second would take longer than recorded human history.

Brainpool curve implementations currently are weaker than NIST curves
because of timing side channels.

Sincerely,
Watson Ladd
>
> https://datatracker.ietf.org/doc/draft-sheffer-uta-tls-attacks/
>
> https://datatracker.ietf.org/doc/draft-sheffer-tls-bcp/
>
> https://datatracker.ietf.org/doc/draft-saintandre-xmpp-tls/
>
> Peter
>
> --
> Peter Saint-Andre
> https://stpeter.im/
>
> _______________________________________________
> Uta mailing list
> Uta@ietf.org
> https://www.ietf.org/mailman/listinfo/uta

-- 
"Those who would give up Essential Liberty to purchase a little
Temporary Safety deserve neither  Liberty nor Safety."
-- Benjamin Franklin