Subject: [Curdle] Multiple choices and authentication-only

From: "Paul Hoffman" <[email-masked]>
Date: Sat, 20 Feb 2016 09:16:44 -0800

Some of the drafts proposed here are for algorithms that are only for 
authentication. If we have two options for those, "strong" and 
"stronger", essentially no one will choose "strong" because they would 
look "weak" doing so even if the authentication they need is completely 
satisfied by "strong". So we are in essence telling people "to look 
secure, you should always use 'stronger'".

Fortunately, for EC, the message size and signing/verifying time is not 
a big issue, particularly because in most protocols these will (still!) 
be replacing RSA authentication. However, having two sizes means more 
operational complexity because each signer needs to decide (without 
enough guidance) which size to use.

If you truly believe that 128 bit work factor is not sufficient for a 
particular IETF protocol, it would be good for this WG to hear why. 
"Because the NSA uses it for 'top secret' which most of us don't even 
know the definition of" isn't sufficient for me, but it might be for 
others.

--Paul Hoffman

---

From: Yoav Nir <[email-masked]>
Date: Sat, 20 Feb 2016 20:35:19 +0200

> On 20 Feb 2016, at 7:16 PM, Paul Hoffman <[email-masked]> wrote:
> 
> Some of the drafts proposed here are for algorithms that are only for authentication. If we have two options for those, "strong" and "stronger", essentially no one will choose "strong" because they would look "weak" doing so even if the authentication they need is completely satisfied by "strong". So we are in essence telling people "to look secure, you should always use 'stronger’”.

I don’t think this is an inevitable outcome. NIST curves came in three levels of “strength”. P-256, P-384, and P-521. P-256 is use much more than P-384, and P-521 is practically unheard of (53748:12:1 according to [1]).  Before that, RSA came in whatever bit-length you wanted, and yet until a year ago, 1024-bits was more popular than 2048 bits, even though pretty much every implementation out there supported at least 4096 bits. Even now only 4% of web servers use stronger than 2048-bit RSA.

> 
> Fortunately, for EC, the message size and signing/verifying time is not a big issue, particularly because in most protocols these will (still!) be replacing RSA authentication. However, having two sizes means more operational complexity because each signer needs to decide (without enough guidance) which size to use.

And we can put such advice in the RFC. In any case, this is not some green field where we can have only one option. Every protocol implementation will add these curves (or curve) to an implementation that already has RSA, ECDSA, and possibly DSA.

> If you truly believe that 128 bit work factor is not sufficient for a particular IETF protocol, it would be good for this WG to hear why. "Because the NSA uses it for 'top secret' which most of us don't even know the definition of" isn't sufficient for me, but it might be for others.

As far as we know, there is no good reason for it now. Our operational considerations are very different from those of the NSA. But we’ve always standardized “goes up to 11” or “ridiculous speed” algorithms. 256-bit AES comes to mind. 

Yoav

[1] https://securitypitfalls.wordpress.com/2015/12/07/november-2015-scan-results/