Subject: RE: PKINIT-23: DH GROUP SELECTION: ticket 530

From: "Paul Leach" <[email-masked]>
Date: Mon, 7 Feb 2005 23:26:18 -0800

I'd be inclined to mandate the more secure mode (longer key lengths and
bigger DH groups) and leave to more efficient modes (shorter key lengths
or smaller DH groups) as options.

But I guess I don't have a strong opinion one way or another.

> -----Original Message-----
> From: [email-masked] [mailto:owner-ietf-krb-
> [email-masked]] On Behalf Of Jeffrey Hutzelman
> Sent: Monday, February 07, 2005 4:47 PM
> To: Sam Hartman; Liqiang(Larry) Zhu
> Cc: [email-masked]
> Subject: Re: PKINIT-23: DH GROUP SELECTION: ticket 530
> 
> 
> 
> On Wednesday, January 26, 2005 06:08:47 PM -0500 Sam Hartman
> <[email-masked]> wrote:
> 
> > I'd recommend looking at mandating support for AES128 in pkinit
> > implementations and suggesting that be used instead of aes256 so you
> > can get a smaller DH group.
> 
> This is now ticket #834.
> 
> One suggestion does not a consensus make.
> Does anyone want to comment on this?
> 
> -- Jeff
>