Re: ECDHE security level

• From: Brian Smith <brian@briansmith.org>
• Date: Fri, 10 Oct 2014 14:16:23 -0700
• To: Martin Thomson <martin.thomson@gmail.com>
• Cc: HTTP Working Group <ietf-http-wg@w3.org>
• Message-ID: <CAFewVt5bf3N8KFXqBqi8jaZQnZ3BqSanbd0+gcBh7n=b5R+Vzg@mail.gmail.com>

On Fri, Oct 10, 2014 at 1:12 PM, Martin Thomson
<martin.thomson@gmail.com> wrote:
> On 10 October 2014 12:58, Brian Smith <brian@briansmith.org> wrote:
>> I
>> merely wanted the language fixed so that P-256 and Curve25519 and
>> others were not forbidden on an unintended technicality, and so that
>> no ambiguous terms like "security level" were used.
>
>
> OK, help me out here.  What would you like to see exactly.  I
> currently have this:
>
> "Ephemeral key exchange MUST have a minimum size of 2048 bits for DHE
> or 255 bits for ECDHE."

I am fine with that. I suggest that some browsers try to implement
those conditions to see how it goes.

Cheers,
Brian

Received on Friday, 10 October 2014 21:16:50 UTC