Subject: Re: agenda items..

From: Niels Provos <[email-masked]>
Date: Tue, 12 Dec 2000 04:47:05 -0500

In message <20001211220024.A886@folly>, Markus Friedl writes:
>similar to AES.  the current keyexchange definitions do not provide
>256 bits of entrophy, since the sha1 output from diffie-hellman-group1-sha1
>is only 160 bits.
The limited entropy is due to the small group size in the
Diffie-Hellman key exchange.  The 160 bits of SHA1 are limiting the
strength of the authentication.  For the AES cipher, we should really
go to something stronger like SHA-512.  Of course that means not to
use DSA any more.  DSA is limited to signing just 160-bits.  We need
to use RSA instead, which seems to be a more secure signature scheme
anyway.

Of course, the collision attack has to be done in real time and is not
feasible, the bigger problem is the limited size of the DH group.

Niels.