Re: [radext] I-D Action: draft-ietf-radext-tls-psk-02.txt

[Alan DeKok <[e-mail]>]

On Aug 20, 2023, at 12:34 PM, Heikki Vatiainen <[e-mail]> wrote:
> Here's my suggestion:
> - first, use IANA recommended ciphersuites; then
> - with TLS 1.3 use "psk_dhe_ke" PSK key exchange mode
> - with TLS 1.2 and earlier use ciphersuites that require ephemeral
> keying. Currently a couple of TLS_(EC)DHE_ prefixed ciphersuites would
> match the both requirements.
> 
> In other words, IANA recommended ciphersuites and ephemeral keying are
> required. It depends on the TLS version (1.3 or earlier) how ephemeral
> keying is expressed; based on the ciphersuite definition (TLS 1.2 and
> earlier) or by requiring a suitable key exchange model (TLS 1.3).

  That makes sense.  I'll add that to the text.

> 
> Regarding my earlier question whether the text "Implementations MUST
> use ECDH cipher suites" wants to mandate only ECDH or was the purpose
> to require ephemeral keying, the question is related to the potential
> DH problems summarised here:
>   https://www.openssl.org/blog/blog/2022/10/21/tls-groups-configuration/
> 
> One of the mitigation suggestions is to disable DH and use only ECDH
> with selected groups. But I'd say there's no need to go to this level
> of detail in an RFC.

  Sure.  I think the earlier 3 items are good enough.

  Alan DeKok.