Bug#476441: Please revist this choice. AES128 vs AES256 (for gnutls)

2014-03-23 Thread Robert de Bath
Okay 'cited': Summary for "drop dead" of TDEA aka 3DES from (for example) http://www.keylength.com/en/4/ Seems to be from: http://csrc.nist.gov/publications/nistpubs/800-67-Rev1/SP-800-67-Rev1.pdf which explicitly drops approval of 3DES in 2030. Re: Windows XP; that's now "officially" no longer

Bug#476441: Please revist this choice. AES128 vs AES256 (for gnutls)

2014-03-23 Thread Daniel Kahn Gillmor
On 03/22/2014 01:27 PM, Robert de Bath wrote: > On Fri, 21 Mar 2014, Daniel Kahn Gillmor wrote: >> which keys are you talking about here? where are these numbers from? > I ran the one line script in this "bug report" against a current Debian > testing install. > > $ for i in /etc/ssl/certs/*; do

Bug#476441: Please revist this choice. AES128 vs AES256 (for gnutls)

2014-03-22 Thread Robert de Bath
On Fri, 21 Mar 2014, Daniel Kahn Gillmor wrote: [re: GnuTLS default ciphers] On 03/21/2014 06:15 AM, Robert de Bath wrote: I notice that the distribution of RSA key sizes distributed with Debian has changed. The 2048 bit keys are still the most common but 20% of the keys are now 4096 bit with

Bug#476441: Please revist this choice. AES128 vs AES256 (for gnutls)

2014-03-21 Thread Daniel Kahn Gillmor
[re: GnuTLS default ciphers] On 03/21/2014 06:15 AM, Robert de Bath wrote: > I notice that the distribution of RSA key sizes distributed with Debian > has changed. > > The 2048 bit keys are still the most common but 20% of the keys are now > 4096 bit with only 12% still being 1024 bit. (The 4k an

Bug#476441: Please revist this choice. AES128 vs AES256

2014-03-21 Thread Robert de Bath
I notice that the distribution of RSA key sizes distributed with Debian has changed. The 2048 bit keys are still the most common but 20% of the keys are now 4096 bit with only 12% still being 1024 bit. (The 4k and 1k keys have basically changed places) Based on the (now rather dated IMO) papers