Re: speaking of keys

[Geoff Keating <geoffk@geoffk.org>]

Russ Housley <housley@vigilsec.com> writes:

> Steve:
> 
> I support your recommendation.  In fact, I was going to make the same
> recommendation, but for a different reason.  I few weeks ago, we had a
> long thread discussing mandatory to implement signature algorithms.
> We decided that RSA with 1024-bit keys will be mandatory to implement.
> So, if 1024 bits is adequate for the signature, it seems like 1024
> should also be adequate for the key agreement algorithm.

The threat model is different for signature vs. key agreement.  An
identity verification algorithm must be broken before the identity is
verified to have any impact, and can be changed in a short time if it
starts to become ineffective.  A confidentality algorithm need only be
broken before the data it protects loses value, which is a much longer
timespan in IKE/IPSEC, and the algorithm used to protect data in the
past can't be changed.  Thus, it doesn't follow that the algorithm
used for key agreement need not be more secure than the one used for
identity verification.

-- 
- Geoffrey Keating <geoffk@geoffk.org>