Subject: Re: [TLS] [Cfrg] 3DES diediedie

From: Kyle Rose <[email-masked]>
Date: Thu, 1 Sep 2016 11:51:38 -0700

On Mon, Aug 29, 2016 at 5:00 AM, Hubert Kario <[email-masked]> wrote:

>
> we have enough problems weeding out implementation mistakes in TLS, we
> don't
> need yet another protocol and two dozen implementations that come with it
>

Strongly agreed.

Focusing energy on getting "something" working for low-power devices is
putting the cart before the horse. Security has to be a primary objective
here, in the standards world in general and in CFRG in particular. We can
surely consider tradeoffs---more frequent key rotations, security
guarantees reduced in a well-defined way, shorter lifetimes for
credentials, etc.---but these should be explicitly chosen, not determined
after the fact based on what happened to be in our toolbox at the time.
Keeping 3DES around in a general-purpose protocol headed for
standardization in spite of the known problems with small block sizes is
almost certain to create more work in the coming years for everyone simply
to benefit implementors of systems for which security is clearly not the
primary concern.

>From following the discussion, low power crypto seems like a research area
at this point, not an implementation effort. (Of course, the flaws in
whatever ill-advised schemes get implemented will generate their own
research efforts and inevitable transitive trust problems with supposedly
more-secure systems. Alas, we haven't yet figured out a way to keep people
from generating sufficient rope to hang themselves with.)

Kyle

---

From: Richard Hartmann <[email-masked]>
Date: Thu, 1 Sep 2016 22:22:49 +0200

On Aug 25, 2016 04:08, "Tony Arcieri" <[email-masked]> wrote:

> Should there be a 3DES "diediedie"?

Strongly +1.

Makers of tiny devices with legacy chips will simply keep on using whatever
they want anyway. This is not a good reason to drag risk for everyone with
us forevermore.

Richard

---

From: Derek Atkins <[email-masked]>
Date: Fri, 02 Sep 2016 13:00:17 -0400

"Steven M. Bellovin" <[email-masked]> writes:

> On 31 Aug 2016, at 10:17, Derek Atkins wrote:
>
>> "Steven M. Bellovin" <[email-masked]> writes:
>>
>>> Yes.  To a large extent, the "IoT devices are too puny for real
>>> crypto" is a hangover from several years ago. It was once true; for
>>> the most part, it isn't today, but people haven't flushed their cache
>>> from the old received wisdom.
>>
>> This is certainly true for AES, mostly because many small chips are
>> including AES accelerators in hardware.  It's not quite true for public
>> key solutions; there are still very small devices where even ECC takes
>> too long (and yes, there are cases where 200-400ms is still too long).
>>
> Certainly plausible.  What I'm saying is (a) don't assert, measure; and
> (b) measure again next year because tech keeps improving.
>
> As for your specific points: if AES is indeed feasible, we don't need
> new ciphers.

It is feasible in many cases.  It may not be feasible in all cases.

>     If elliptic curve is too slow, the only answer is architectures
> that don't use public key at all; we're not going to find new, cheaper
> public key algorithms without a *lot* of effort and the people who can
> do that sort of thing are too busy working on post-quantum crypto.

Nothing says these two aren't the same problem ;)

> The remaining approach is a cheaper protocol than TLS.  That shouldn't
> be hard at all, especially if we're going back to KDCs.

True.

>         --Steve Bellovin, https://www.cs.columbia.edu/~smb

-derek

-- 
       Derek Atkins                 617-623-3745
       [email-masked]             www.ihtfp.com
       Computer and Internet Security Consultant