[Cryptography] Long-term security (was Re: ratcheting DH strengths over time)

[Perry E. Metzger]

On Tue, 17 Nov 2015 03:34:23 +0000 Peter Gutmann
<pgut001 at cs.auckland.ac.nz> wrote:
> Bill Frantz <frantz at pwpconsult.com> writes:
> >But people still use the old ones because they continue to work,
> 
> Yeah, that's the killer, until they explode or melt they'll
> continue to be used.  There's some upgrade pressure from ADSL1 ->
> ADSL2 -> fibre, but even then what'll get put in is the cheapest,
> crappiest router the ISP can source for you.

And of course, the users cannot for practical purposes be relied on to
do security patching or indeed any sort of software upgrades. Many
users of home routers simply plug them in and don't even know that
they can open a web page to configure them, and wouldn't know what any
of the configuration options mean either.

Fully automated patching seems like the only solution there (at least
by default unless you configure it not to), but given the price
pressures and the lack of consumer demand, it seems unlikely that the
average vendor will do that.

Perry
-- 
Perry E. Metzger		perry at piermont.com