Re: speaking of keys

[Russ Housley <housley@vigilsec.com>]

Geoff:

I understand this asymmetry.  However, if one is trying to design hardware 
to accelerate the processing, then it would be nice to have a common size 
for all of the public key operations.

Russ

At 12:54 PM 12/9/2002 -0800, Geoff Keating wrote:
>Russ Housley <housley@vigilsec.com> writes:
>
> > Steve:
> >
> > I support your recommendation.  In fact, I was going to make the same
> > recommendation, but for a different reason.  I few weeks ago, we had a
> > long thread discussing mandatory to implement signature algorithms.
> > We decided that RSA with 1024-bit keys will be mandatory to implement.
> > So, if 1024 bits is adequate for the signature, it seems like 1024
> > should also be adequate for the key agreement algorithm.
>
>The threat model is different for signature vs. key agreement.  An
>identity verification algorithm must be broken before the identity is
>verified to have any impact, and can be changed in a short time if it
>starts to become ineffective.  A confidentality algorithm need only be
>broken before the data it protects loses value, which is a much longer
>timespan in IKE/IPSEC, and the algorithm used to protect data in the
>past can't be changed.  Thus, it doesn't follow that the algorithm
>used for key agreement need not be more secure than the one used for
>identity verification.
>
>--
>- Geoffrey Keating <geoffk@geoffk.org>