Subject: Re: [saag] draft-iab-crypto-alg-agility-01.txt

From: Peter Gutmann <[email-masked]>
Date: Wed, 15 Apr 2015 09:04:58 +0000

ianG <[email-masked]> writes:

>Again, these are envelope calculations, at the margin.  They aren't features.
>They literally only exist because *there is a choice*.  If there was no
>choice, I'm pretty sure that they'd figure it out...

That's an interesting point, what's the tail and what's the dog?  Tell users
that they can choose, among other things, options like
TLS_DHE_RSA_WITH_CAMELLIA_3D_ROUNDED_CORNERS_RSS_PUSH_NOTIFICATION_AND_SPINNERS
and they'll discover they have an absolutely mission-critical requirement for
just that.  Tell them "TLS_DHE_RSA_WITH_AES_SHA256, like it or leave it" and
they'll say "yeah, that'll do".

Peter.

---

From: Derek Atkins <[email-masked]>
Date: Wed, 15 Apr 2015 10:31:34 -0400

> they'll say "yeah, that'll do".

... except when it doesn't.  :)

> Peter.

-derek

-- 
       Derek Atkins                 617-623-3745
       [email-masked]             www.ihtfp.com
       Computer and Internet Security Consultant

---

From: ianG <[email-masked]>
Date: Wed, 15 Apr 2015 15:37:17 +0100

On 15/04/2015 10:04 am, Peter Gutmann wrote:
> just that.

Secure spinners, hell yeah!

> Tell them "TLS_DHE_RSA_WITH_AES_SHA256, like it or leave it" and

So, could most users cope with that?  I'd say yes, in principle.

If we were to get more concrete and go look at say the TLS WG (which 
isn't this group, it's another) then we could have more arguments about 
performance.  As Derik has rightly brought up.

But I would suggest that if we look at the other 99 groups -- the 
consensus across all IETF as this current draft is about -- most of them 
have less performance envelope to worry about.

In which case a criticism of the 1TCS approach is that in a successful 
protocol that covers a wide swathe of performance territory, there will 
occur a tension between providing a highly efficient but 
just-secure-enough suite versus a less efficient but highly-efficient suite.

But this criticism should really only be applied/reserved for those 
protocols that have achieved remarkable penetration across the spectrum. 
  It can also be seen as a nice problem to have.

iang