Re: [TLS] Re: TLS 1.2 draft

Steven M. Bellovin wrote:
> 
> On Wed, 07 Mar 2007 10:53:00 +0100
> Simon Josefsson <simon@josefsson.org> wrote:
> 
> > Eric Rescorla <ekr@networkresonance.com> writes:
> > 
> > > What I'm saying is that the recommendation to prevent his attack
> > > is to use an RSA_DHE ciphersuite
> > 
> > I agree with that.  However, if I remember correctly, DHE key
> > exchanges are generally slower than plain RSA key exchanges with
> > temporary keys, although it depends on the DH group size.
> 
> The problem is generating the two large primes for the RSA key pair.

I agree that a full RSA keygen, in particular for same-size (>=1024 bit)
temporary RSA keypairs as the servers certificate is a sure
performance-killer.

However, the protocol does not preclude the use of an SSL servers
temporary keypair for multiple handshakes, say one or a few hours.
SSH servers have been doing this for years.

I admit to have very little experience with most crypto math and
never implemented cryptographic algorithms myself.
I do maintenance on code that implements RSA, but I have never
looked at code for DH, so I can not really comment on that.

-Martin

_______________________________________________
TLS mailing list
TLS@lists.ietf.org
https://www1.ietf.org/mailman/listinfo/tls