[Cryptography] The One True Cipher Suite

[Phillip Hallam-Baker]

On Tue, Sep 10, 2013 at 7:42 AM, Jerry Leichter <leichter at lrw.com> wrote:

> On Sep 9, 2013, at 12:00 PM, Phillip Hallam-Baker wrote:
> > Steve Bellovin has made the same argument and I agree with it.
> Proliferation of cipher suites is not helpful.
> >
> > The point I make is that adding a strong cipher does not make you more
> secure. Only removing the option of using weak ciphers makes you more
> secure.
> I'm not so sure I agree.  You have to consider the monoculture problem,
> combined with the threat you are defending against.
>

I really hate the monoculture argument. It misses the fact that evolution
of Internet applications and attack strategies is not according to
Darwinian evolution.

Diversity is only a successful strategy against Darwinian evolution. It
does not work against intelligent design and malware is a product of
intelligent design.


Whether it is better to put all your eggs in one basket or in many baskets
depends on the consequences of compromise.

If the loss of one egg is acceptable then many baskets is the way to go. If
on the other hand they are dragon eggs and the loss of just one is a
catastrophe then putting them all in one basket is the lowest risk strategy.

1.  If everyone uses the same cipher, the attacker need only attack that
> one cipher.
> 2.  If there are thousands of ciphers in use, the attacker needs to attack
> some large fraction of them.
>

But on the flip side the cost of developing ciphers is large and the
vulnerabilities introduced into a protocol through support for algorithm
negotiation are significant.

Moreover as Newt Gingrich discovered, it only takes one party to your
conversation to be using an old AMPS analog line for your conspiracy to be
revealed.


I would rather choose one algorithm and one additional strong algorithm as
a backup than have the hundreds of algorithms.


-- 
Website: http://hallambaker.com/
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://www.metzdowd.com/pipermail/cryptography/attachments/20130910/0b246c46/attachment.html>