[TLS] DHE key derivation

While we're opening (maybe) the negotiation of DHE, I'd like to clarify 
an issue that bothers me in the implementation of DHE in TLS:

With DHE, the premaster secret depends only on the DH shared secret. We 
know that DHE is commonly used with 1024-bit parameters. So even if you 
have a 2048-bit RSA certificate, the session strength will be 1024 bits.

What if we mixed *both* the DH secret and the regular encrypted nonce 
that's used in RSA ciphersuites into the premaster secret? Wouldn't we 
get forward secrecy, as well as crypto strength equivalent to the higher 
of the two lengths?

Thanks,
	Yaron

On 09/27/2013 04:48 PM, Yoav Nir wrote:
>
> On Sep 26, 2013, at 6:00 PM, Yngve N. Pettersen <yngve@spec-work.net> wrote:
>
>> Hi,
>>
>>
>> On Thu, 26 Sep 2013 16:51:43 +0200, Wan-Teh Chang <wtc@google.com> wrote:
>>
>>> On Thu, Sep 26, 2013 at 7:15 AM, Phillip Hallam-Baker <hallam@gmail.com> wrote:
>>>> My understanding of the 1024 bit Ephemeral DH key issue is that it is not
>>>> currently possible to use longer keys because a certain number of deployed
>>>> Web servers will abort the connection if a client presents a longer key.
>>>
>>> The size of ephemeral DH keys is specified by the server, and the
>>> client must present a key of that size. (This doesn't change the
>>> problem though.)
>>>
>>> The client needs a way to negotiate the ephemeral DH key size (or the
>>> DH domain parameters) with the server. This can be done by either an
>>> extension (similar to the elliptic_curves extension of RFC 4492 for
>>> ephemeral ECDH keys) or new cipher suites.
>>
>> In my opinion the length of the DHE key should have at least the same length (number of bits) as the signing RSA key. And similar for ECDHE, if necessary.
>
> Not for ECDHE_RSA, though. That would require that we define what ECDHE curve is equivalent to X-bit RSA.
>
> In general I don't like us doing the NIST magic tables of naming equivalent strength key lengths among different algorithms, as in 1024-bit RSA is similar to some non-existing 80-bit perfect symmetric algorithm, and a 1024-bit MODP group is sort of like that.
>
> Yoav
>
> _______________________________________________
> TLS mailing list
> TLS@ietf.org
> https://www.ietf.org/mailman/listinfo/tls
>