Re: [nznog] I don't trust the NZRS DNSSEC procedures... Yet

On Fri, Jun 10, 2011 at 08:07:22AM +1200, Joel Wiramu Pauling wrote:

On 10 June 2011 07:51, wrote:

...

Well - thats an easy answer for me:

) bigger keys == bigger packets == more cost of bandwidth ) bigger keys == bigger packets == more cost for CPU ) bigger keys -WITH THE SAME ALGORITHM- are vulnerable to cracks in the algo. So 10years is likely worthless for me.

All valid arguments to be sure. But... then again, this is roughly synonymous with the "why bother locking your front door..." argument.

right. do you get a lock that is "good enough" or are you going to spend the money/effort to maintain a 3m thick blast door while not worrying about the flimsy lath & stucco walls? As young Dean points out, the focus on the keysize sticker on the side'o'thebox is misguided. a well designed crypto/key management system - with a credible understaning of the actual threats - will (nearly) always pick the correct algo & keysize needed for the job. //bill