Re: [TLS] security levels for TLS

[Mike <[e-mail]>]

There are two aspects to this that I see:

   1) a TLS client should be configurable such
      that it will reject negotiated sessions
      that don't satisfy its requirements.  The
      configurable parameters would include the
      minimum acceptable size for RSA and DSA
      keys, and DH parameters (p).  This can be
      done now without any changes to TLS, but
      has the problem that several attempts may
      be necessary to establish an acceptable
      connection.

   2) a TLS client might want to tell the server
      that if TLS_DHE_RSA_WITH_AES_128_CBC_SHA1
      is the negotiated cipher, it will accept
      a minimum RSA key size of X and a minimum
      DH parameter size of Y.  If the server
      has several sets of DH parameters (such as
      those in RFC 3526), it would select one
      that meets the minimum and is smallest for
      best performance.  If the server doesn't
      have the ability to satisfy the minimums,
      it could return an insufficient_security
      fatal alert.

Support for (2) could be added using an extension:

   enum {
       RSA,
       DHE_RSA,
       DHE_DSS,
       ...
   } KeyExchangeAlgorithm;

   struct {
       CipherSuite         cipher_suite;
       HashType            mac_algorithm<0..255>; // possible
       select (KeyExchangeAlgorithm) {
           case RSA:
               uint16      rsa_key_size;          // bytes
               uint16      premaster_secret_size; // possible
           case DHE_RSA:
               uint16      rsa_key_size;          // bytes
               uint16      dh_group_size;         // bytes
           case DHE_DSS:
               uint16      dsa_key_size;          // bytes
               uint16      dh_group_size;         // bytes
           case ....
       };
   } SecurityRequirements;

The client would package up SecurityRequirements
structures for each of the cipher suites listed in
its ClientHello message.

Notice the possibility to change the MAC algorithm
without needing to define new cipher suites.  A list
is used to be able to specify preferences (and can be
empty for AEAD ciphers).

The server would return a single SecurityRequirements
corresponding to the selected cipher suite, containing
the parameters chosen (MAC algorithm, premaster secret
size, etc.).

Mike



_______________________________________________
TLS mailing list
[e-mail]
https://www1.ietf.org/mailman/listinfo/tls