On 8/1/22 2:58 PM, Cullen Jennings wrote:
On Jul 30, 2022, at 1:40 PM, Peter Saint-Andre <stpeter@xxxxxxxxxx> wrote:
Hi again,
The authors have conferred on this and at this time we don't think that we can recommend anything other than EC ciphers, for several reasons:
1. DHE negotiation is broken.
Perhaps a bit more explanation in the draft about the issues with DHE-RSA (in context of 7919) would help.
For sure. We weren't crafting text yet, merely pointing out the basic
rationale behind exclusing non-EC ciphersuites. We can definitely
explain each of these three reasons more fully in text to follow.
I was under the perhaps mistaken perception that the RFC 7919 was not subject to the Raccoon attack and that there were mitigation for the Racoon timing attacks. Given the reliance on a single class of algorithms, I think it would be worth highlighting the risks and provide good info on why alternatives don’t work.
Agreed.
2. Static RSA is out of the question.
I agree but would prefer that was phrased as things don’t provide PFS are out of the question, not that RSA is not usable.
That makes sense.
I see lots of confusion of those two. I will note that, if EC was broken by quantum or optical computers but RSA was not, I’m pretty sure I would be switching to something with no PFS vs something that was broken.
Very likely. :-)
3. Post-quantum (PQ) methods aren't ready yet.
agree (thought I think they are getting surprising close and probably plan to ship them well ahead of any schedule I imagine the IETF getting around to agreeing on )
Our forecast is that a few years from now the PQ methods will be ready for recommending in 7525ter, but for now EC is the best we can do.
I suspect that 7525ter will be published after the PQ methods have been
standardized at the IETF, but as we know it's never smart to make
specific forecasts about standardization schedules. ;-)
Peter
--
last-call mailing list
last-call@xxxxxxxx
https://www.ietf.org/mailman/listinfo/last-call
