Subject: Re: [TLS] Comparative cipher suite strengths

From: [email-masked]
Date: Tue, 21 Apr 2009 17:03:02 +0100

>On Tue 21/04/09 4:55 PM , Eric Rescorla [email-masked] sent:
>>At Tue, 21 Apr 2009 16:32:54 +0100, Carl Young wrote:
>> 
>> So, for TLS_RSA_WITH_3DES_EDE_CBC_SHA, assuming an RSA 1024 bit key-pair, 
>> would the effective strength of the connection be 80 bits or am I looking to 
>> compare apples and oranges?
>>
>> If I want to negotiate AES-256, should I really be using a 15360 bit RSA key 
>> or, again, am I looking at this in the wrong way?
>
>Well, I think that this last bit is certainly looking at it the wrong
>way. We don't know of any conditions under which AES-256 would be
>breakable and AES-128 would not be, so talking about "key strength"
>just doesn't make much sense at that level.

The "key strength" would be limited by the weakest link in the suite though wouldn't it, which, in this case, is the RSA keys? Or are you saying that the additional security of the PRF, key derivation mechanisms, and the entropy in the random data overcomes this?

I suppose what I'm trying to establish is that [hypothetically] if the technology existed to brute-force attack a 1024 bit RSA key pair in a short time-frame (say 1-2 days), would the attacker be able to recover the AES-256 keys used in the TLS session and decode the complete session, or is it more involved in that?

Thanks,

Carl

---

From: Eric Rescorla <[email-masked]>
Date: Tue, 21 Apr 2009 09:40:30 -0700

At Tue, 21 Apr 2009 17:03:02 +0100,
[email-masked] wrote:
> The "key strength" would be limited by the weakest link in the suite
> though wouldn't it, which, in this case, is the RSA keys? Or are you
> saying that the additional security of the PRF, key derivation
> mechanisms, and the entropy in the random data overcomes this?

No, I'm saying that talking about trying to match anything to 
AES-256 doesn't make sense. We don't know of any situation in
which even AES-128 can be attacked.

> I suppose what I'm trying to establish is that [hypothetically] if
> the technology existed to brute-force attack a 1024 bit RSA key pair
> in a short time-frame (say 1-2 days), would the attacker be able to
> recover the AES-256 keys used in the TLS session and decode the
> complete session, or is it more involved in that?

If you're using static RSA (i.e., not DHE), then recovery of the RSA private
key suffices to recover the traffic keys.

-Ekr

---

From: Simon Josefsson <[email-masked]>
Date: Wed, 22 Apr 2009 12:35:37 +0200

> which even AES-128 can be attacked.

What we can always do, though, is to compare the amount of work needed
to break AES-256 with the amount of work needed to break RSA-y using
state-of-the-art attacks.  It's possible that this imply y=15360.

However, I agree that this is looking at things the wrong way.  The
exercise should not have any practical consequences on what key sizes
you use.  One should focus on selecting appropriate security level for
each algorithm.  Today AES-128 and RSA-2048 will probably make
implementation bugs the weakest link for the majority of users.

/Simon