> On Jul 30, 2022, at 1:40 PM, Peter Saint-Andre <stpeter@xxxxxxxxxx> wrote: > > Hi again, > > The authors have conferred on this and at this time we don't think that we can recommend anything other than EC ciphers, for several reasons: > > 1. DHE negotiation is broken. Perhaps a bit more explanation in the draft about the issues with DHE-RSA (in context of 7919) would help. I was under the perhaps mistaken perception that the RFC 7919 was not subject to the Raccoon attack and that there were mitigation for the Racoon timing attacks. Given the reliance on a single class of algorithms, I think it would be worth highlighting the risks and provide good info on why alternatives don’t work. > > 2. Static RSA is out of the question. I agree but would prefer that was phrased as things don’t provide PFS are out of the question, not that RSA is not usable. I see lots of confusion of those two. I will note that, if EC was broken by quantum or optical computers but RSA was not, I’m pretty sure I would be switching to something with no PFS vs something that was broken. > > 3. Post-quantum (PQ) methods aren't ready yet. agree (thought I think they are getting surprising close and probably plan to ship them well ahead of any schedule I imagine the IETF getting around to agreeing on ) > > Our forecast is that a few years from now the PQ methods will be ready for recommending in 7525ter, but for now EC is the best we can do. > > Peter -- last-call mailing list last-call@xxxxxxxx https://www.ietf.org/mailman/listinfo/last-call
