Re: [TLS] I-D Action: draft-ietf-tls-negotiated-ff-dhe-02.txt

[Nikos Mavrogiannopoulos <[e-mail]>]

----- Original Message -----
> On Sat, Oct 25, 2014 at 1:16 PM, Ilari Liusvaara
> <[e-mail]> wrote:
> > On Sat, Oct 25, 2014 at 12:55:58PM -0700, Watson Ladd wrote:
> >> On Sat, Oct 25, 2014 at 12:51 PM, Nikos Mavrogiannopoulos
> >> <[e-mail]> wrote:
> >>
> >> > 3. There are known attacks against the current ServerKeyExchange format
> >> > which
> >> > remain applicable if we go this path (a sufficiently long DH
> >> > serverkeyexchange
> >> > message can be parsed as an ECDH serverkeyexchage).
> >>
> >> And 4: session_hash solves the same problem if I understand the
> >> elements of it correctly, and we need it anyway because of this
> >> ambiguity in parsing mentioned above. So do we even need this draft?
> >
> > AFAIK, no, it won't, at least not completely.
> 
> I'm afraid I didn't realize how what I wrote would be read. It seems
> to me that the session_hash doesn't necessarily fix the ambiguity
> issue, but does ensure that sending bad groups will achieve nothing
> for an attacker. Even if we adopt this draft for DHE, session_hash is
> still needed in TLS 1.2. So what does this draft get us, assuming
> session_hash is deployed?

I think it is a bit unproductive to comment without reading the actual
draft. The issue it solves is unrelated to session hash. It is described
in its introduction at
https://tools.ietf.org/html/draft-ietf-tls-negotiated-ff-dhe-02#section-1

"Traditional TLS [RFC5246] offers a Diffie-Hellman ephemeral (DHE) key
   exchange mode which provides Perfect Forward Secrecy for the
   connection.  The client offers a ciphersuite in the ClientHello that
   includes DHE, and the server offers the client group parameters g and
   p.  If the client does not consider the group strong enough (e.g. if
   p is too small, or if p is not prime, or there are small subgroups),
   or if it is unable to process it for other reasons, it has no
   recourse but to terminate the connection ..."

regards,
Nikos