Bug#476441: Please revist this choice. AES128 vs AES256 (for gnutls)

2014-03-23 Thread Daniel Kahn Gillmor
On 03/22/2014 01:27 PM, Robert de Bath wrote: On Fri, 21 Mar 2014, Daniel Kahn Gillmor wrote: which keys are you talking about here? where are these numbers from? I ran the one line script in this bug report against a current Debian testing install. $ for i in /etc/ssl/certs/*; do certtool

Bug#476441: Please revist this choice. AES128 vs AES256 (for gnutls)

2014-03-23 Thread Robert de Bath
Okay 'cited': Summary for drop dead of TDEA aka 3DES from (for example) http://www.keylength.com/en/4/ Seems to be from: http://csrc.nist.gov/publications/nistpubs/800-67-Rev1/SP-800-67-Rev1.pdf which explicitly drops approval of 3DES in 2030. Re: Windows XP; that's now officially no longer a

Bug#476441: Please revist this choice. AES128 vs AES256 (for gnutls)

2014-03-22 Thread Robert de Bath
On Fri, 21 Mar 2014, Daniel Kahn Gillmor wrote: [re: GnuTLS default ciphers] On 03/21/2014 06:15 AM, Robert de Bath wrote: I notice that the distribution of RSA key sizes distributed with Debian has changed. The 2048 bit keys are still the most common but 20% of the keys are now 4096 bit

Bug#476441: Please revist this choice. AES128 vs AES256 (for gnutls)

2014-03-21 Thread Daniel Kahn Gillmor
[re: GnuTLS default ciphers] On 03/21/2014 06:15 AM, Robert de Bath wrote: I notice that the distribution of RSA key sizes distributed with Debian has changed. The 2048 bit keys are still the most common but 20% of the keys are now 4096 bit with only 12% still being 1024 bit. (The 4k and 1k