Subject: [saag] Retire 1024 bit DH

From: Watson Ladd <[email-masked]>
Date: Thu, 15 Oct 2015 06:56:29 -0400

Dear all,
Most attack papers use uncomfortably round numbers in time estimates.
Unfortunately estimates of 1024 prime field discrete logarithm times
made a second mistake, relying on sieving and ignoring the possibility
of dedicated hardware for finding smooth factors. In addition there is
a potential to batch the relation gathering in the number field sieve
across multiple primes.

These estimates have been done by Bernstein and Lange for RSA in [1]
but I believe that their methods can be extended to the discrete log
problem trivially. Furthermore, precomputation techniques can make
this attack almost realtime. As a result we should assume that all
data protected by 1024 bit Diffie-Hellman are readable by a nation
state attacker today.

Sincerely,
Watson

[1] http://cr.yp.to/factorization/batchnfs-20141109.pdf

---

From: Stephen Farrell <[email-masked]>
Date: Thu, 15 Oct 2015 12:02:07 +0100

Seems reasonable and might even help some folks transition away from
tools that still have that restriction if those aren't all fixed
already. (Not sure.)

I'd be interested in opinions as to whether it'd be useful for this
to be processed as a BCP or what, and if so, if someone's willing to
volunteer to do the editing work. (Let me know offlist for the latter.)

S.

On 15/10/15 11:56, Watson Ladd wrote:
> _______________________________________________
> saag mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/saag
>

---

From: Yoav Nir <[email-masked]>
Date: Thu, 15 Oct 2015 14:15:00 +0300

Both TLS and IPsecME are retiring 1024-bit DH. TLS is not including it in 1.3, and at IPsecME we're revving 4307 to make it a SHOULD NOT at least.

Regards,

Yoav

Sent from my Windows Phone 

-----Original Message-----
From: "Stephen Farrell" <[email-masked]>
Sent: ‎10/‎15/‎2015 14:02
To: "Watson Ladd" <[email-masked]>; "[email-masked]" <[email-masked]>
Subject: Re: [saag] Retire 1024 bit DH

S.

---

From: Watson Ladd <[email-masked]>
Date: Thu, 15 Oct 2015 07:35:41 -0400

On Thu, Oct 15, 2015 at 7:15 AM, Yoav Nir <[email-masked]> wrote:
> Both TLS and IPsecME are retiring 1024-bit DH. TLS is not including it in
> 1.3, and at IPsecME we're revving 4307 to make it a SHOULD NOT at least.

I think we still need a BCP for several reasons:
-New versions and crypto fixes take years to be deployed (see BEAST).
A BCP tells (the few who read them) systems administrators and users
what they can do now.
-Lots of protocols will have problems here, and in some cases (SSH)
there is no WG handling it anymore. Even if protocols have other
options, they may require administrative action to deploy.
-We're seeing real world exploitation, as with IKE v1 aggressive mode
(where we know exactly what the NSA is doing. No surprise, it's been
known for years)

I'd volunteer to write it, but for some reason (me!) the other drafts
I've at one point tried to write have been languishing on my hard
drive for months.
> ________________________________
> From: Stephen Farrell
> To: Watson Ladd; [email-masked]

-- 
"Man is born free, but everywhere he is in chains".
--Rousseau.

---

From: "Dang, Quynh" <[email-masked]>
Date: Thu, 15 Oct 2015 11:42:03 +0000

This would be a very good item to take care of.

Quynh. 

________________________________________
From: saag <[email-masked]> on behalf of Watson Ladd <[email-masked]>
Sent: Thursday, October 15, 2015 7:35 AM
To: Yoav Nir
Cc: [email-masked]
Subject: Re: [saag] Retire 1024 bit DH

---

From: Daniel Migault <[email-masked]>
Date: Thu, 15 Oct 2015 12:41:35 +0000

Hi, 

This would be good to clearly have that statement, which could would make all protocols start their own cleanup. One other reason I think this document would be useful for is that it would make everyone aware that crypto protocols are evolving, and that deployment must consider their config will be updated overtime.  

BR, 
Daniel
-----Original Message-----
From: saag [mailto:[email-masked]] On Behalf Of Dang, Quynh
Sent: Thursday, October 15, 2015 7:42 AM
To: Watson Ladd; Yoav Nir
Cc: [email-masked]
Subject: Re: [saag] Retire 1024 bit DH

Quynh. 

On Thu, Oct 15, 2015 at 7:15 AM, Yoav Nir <[email-masked]> wrote:
> Both TLS and IPsecME are retiring 1024-bit DH. TLS is not including it 
> in 1.3, and at IPsecME we're revving 4307 to make it a SHOULD NOT at least.

I think we still need a BCP for several reasons:
-New versions and crypto fixes take years to be deployed (see BEAST).
A BCP tells (the few who read them) systems administrators and users what they can do now.
-Lots of protocols will have problems here, and in some cases (SSH) there is no WG handling it anymore. Even if protocols have other options, they may require administrative action to deploy.
-We're seeing real world exploitation, as with IKE v1 aggressive mode (where we know exactly what the NSA is doing. No surprise, it's been known for years)

I'd volunteer to write it, but for some reason (me!) the other drafts I've at one point tried to write have been languishing on my hard drive for months.
> I'd be interested in opinions as to whether it'd be useful for this to 
> be processed as a BCP or what, and if so, if someone's willing to 
>> made a second mistake, relying on sieving and ignoring the 
>> possibility of dedicated hardware for finding smooth factors. In 
>> addition there is a potential to batch the relation gathering in the 
>> number field sieve across multiple primes.
>>