Re: [TLS] Does anyone still want dh_rsa and dh_dss?

On Sun, Jun 29, 2014 at 1:45 PM, Michael StJohns <msj@nthpermutation.com> wrote:
> On 6/26/2014 12:14 PM, Eric Rescorla wrote:
>
> We've already removed static RSA for TLS 1.3 but we didn't
> emove dh_rsa and dh_dss (as opposed to dhe_rsa and
> dhe_dss). It seems like the arguments for removing static
> RSA apply even more strongly here.
>
> Is there any reason to retain these in TLS 1.3?
>
>
> Would it be more appropriate to ask this in  a more crypto-neutral manner?
> E.g. We've removed Public Key Transport as a valid mechanism for pre-master
> setup.  So instead maybe ask this as "Should we remove all non-ephemeral key
> agreement mechanisms?"
>
> Or is there some reason to retain non-ephemeral ECDH vice non-ephemeral DH?

Yes, there is potentially.

With DH on genus 0 we need to restrict parameter choices. Existing
certificates probably don't fit into that framework, so won't work.

However, I do think we should chuck both out because they are not
forward secure.
Sincerely,
Watson Ladd
>
> Mike
>
>
>
> -Ekr
>
>
>
> _______________________________________________
> TLS mailing list
> TLS@ietf.org
> https://www.ietf.org/mailman/listinfo/tls
>
>
>
> _______________________________________________
> TLS mailing list
> TLS@ietf.org
> https://www.ietf.org/mailman/listinfo/tls
>

-- 
"Those who would give up Essential Liberty to purchase a little
Temporary Safety deserve neither  Liberty nor Safety."
-- Benjamin Franklin