Re:How to botch TLS forward secrecy
by pbsd on Friday June 28, 2013 @08:02AM
(#5957466)
> Ideally the DH group would match or exceed the RSA key size but 1024-bit DHE is arguably better than straight 2048-bit RSA
So let's argue!
It depends on how you presume the attacker is gonna get you. Suppose the attacker is well-funded enough to go after one RSA-1024 or DH-1024 instance. Unlike RSA, however, DHE tends to work modulo the same prime over and over. This has consequences for cryptanalysis: once the attacker has solved a single DH instance, they can solve the next one much faster [2]. In the case of 1024-bit DH, the subsequent instances can be solved in about 2^55 time (versus about 2^80 for the first log); this is not instant, but it's pretty quick for a well-funded and skilled attacker.
Where 1024-bit DHE does shine versus 2048-bit static RSA is against other, less Hollywood, types of key retrieval such as outright hacking.
So let's argue!
It depends on how you presume the attacker is gonna get you. Suppose the attacker is well-funded enough to go after one RSA-1024 or DH-1024 instance. Unlike RSA, however, DHE tends to work modulo the same prime over and over. This has consequences for cryptanalysis: once the attacker has solved a single DH instance, they can solve the next one much faster [2]. In the case of 1024-bit DH, the subsequent instances can be solved in about 2^55 time (versus about 2^80 for the first log); this is not instant, but it's pretty quick for a well-funded and skilled attacker.
Where 1024-bit DHE does shine versus 2048-bit static RSA is against other, less Hollywood, types of key retrieval such as outright hacking.
[1] https://tools.ietf.org/html/rfc2409#page-22
[2] http://www.iacr.org/archive/pkc2006/39580175/39580175.pdf