Re: [radext] I-D Action: draft-ietf-radext-tls-psk-02.txt

[Heikki Vatiainen <[e-mail]>]

On Sun, 20 Aug 2023 at 15:56, Alan DeKok <[e-mail]> wrote:
>
> On Aug 20, 2023, at 2:49 AM, Alexander Clouter <[e-mail]> wrote:
> > "Implementations MUST use ECDH cipher suites", is this not meant to be "Implementations MUST support ECDH cipher suites" or because pinning cipher suites tends to not age well?
>
>   I'll fix that for sure this time.

Here's my suggestion:
- first, use IANA recommended ciphersuites; then
- with TLS 1.3 use "psk_dhe_ke" PSK key exchange mode
- with TLS 1.2 and earlier use ciphersuites that require ephemeral
keying. Currently a couple of TLS_(EC)DHE_ prefixed ciphersuites would
match the both requirements.

In other words, IANA recommended ciphersuites and ephemeral keying are
required. It depends on the TLS version (1.3 or earlier) how ephemeral
keying is expressed; based on the ciphersuite definition (TLS 1.2 and
earlier) or by requiring a suitable key exchange model (TLS 1.3).


Regarding my earlier question whether the text "Implementations MUST
use ECDH cipher suites" wants to mandate only ECDH or was the purpose
to require ephemeral keying, the question is related to the potential
DH problems summarised here:
   https://www.openssl.org/blog/blog/2022/10/21/tls-groups-configuration/

One of the mitigation suggestions is to disable DH and use only ECDH
with selected groups. But I'd say there's no need to go to this level
of detail in an RFC.

--
Heikki Vatiainen
[e-mail]