[Cryptography] Long-term security (was Re: ratcheting DH strengths over time)

[John Denker]

On 11/18/2015 01:39 PM, Jerry Leichter wrote:

> (Not to mention the blowback when a thermostat declares itself
> "obsolete" and shuts down in the middle of a blizzard and someone
> freezes to death.)

In the immortal words of Henny Youngman:  So don't do that then.

Let's stop the the straw-man arguments already.  People have been
solving problems like this, and indeed much harder problems, for
a long time.

For example, an airliner is required to undergo inspection every
100 hours.  However, the engines do not automagically shut down
at the end of the 99th hour.  It is mechanically possible to keep
going, and indeed it's even legal under mild restrictions, if
you read the fine print of the regulations.

Similarly, every 60,000 miles my car tells me "time for service"
which means I need new spark plugs.  However it's only a warning;
the engine does not automagically shut down.

===========

As for the problem of "home routers" ... all my wireless base
stations run DD-WRT, which is open source.  I simply won't buy
hardware that is not DD-WRT-friendly.  So I have lots of options
for updating and/or reconfiguring.  I am not dependent on the 
whims of the original manufacturer.

Also FWIW all such things sit behind a firewall, which consists
of an old laptop running Linux.  So again I have lots of options
for updating and/or reconfiguring.

  I do not imagine that this is "secure" in any absolute sense.
  For starters, I assume that They-Who-Must-Not-Be-Named have 
  long-since stolen the Ubuntu release-signing key.

  Also I do not imagine that Joe Sixpack is interested in
  maintaining (much less setting up) his own firewall.  But
  so what?  Joe doesn't change his own spark plugs, either.
  The first couple of sets are covered under the warranty,
  and after that he can shop around for somebody to do it.

The drug industry is a very unhelpful analogy.  Along with 
the nuclear power industry, it is the poster child for "market
failure".  In any non-broken marketplace, customers can take
into account the long-term cost of ownership when deciding
what to buy.  The carmaker who offers free maintenance for
120,000 miles enjoys a marketing advantage over one who doesn't.
The EPA puts energy-related cost-of-ownership stickers on cars,
refrigerators, et cetera.  The wireless vendor who offers
DD-WRT compatibility and/or free crypto upgrades for N years
enjoys a marketing advantage over one who doesn't.

Dealing with life-limited components is not rocket surgery.
People have been dealing with this general class of problems
for a long, long time.