Re: [TLS] New Algorithm identifier for EDH > 1024 bits?

Hi,

On Thu, 26 Sep 2013 16:51:43 +0200, Wan-Teh Chang <wtc@google.com> wrote:

> On Thu, Sep 26, 2013 at 7:15 AM, Phillip Hallam-Baker <hallam@gmail.com>  
> wrote:
>> My understanding of the 1024 bit Ephemeral DH key issue is that it is  
>> not
>> currently possible to use longer keys because a certain number of  
>> deployed
>> Web servers will abort the connection if a client presents a longer key.
>
> The size of ephemeral DH keys is specified by the server, and the
> client must present a key of that size. (This doesn't change the
> problem though.)
>
> The client needs a way to negotiate the ephemeral DH key size (or the
> DH domain parameters) with the server. This can be done by either an
> extension (similar to the elliptic_curves extension of RFC 4492 for
> ephemeral ECDH keys) or new cipher suites.

In my opinion the length of the DHE key should have at least the same  
length (number of bits) as the signing RSA key. And similar for ECDHE, if  
necessary.

Thus, no need to negotiate a length, or incur any delays caused by having  
to generate a new key to match the length requested by the client, or any  
performance problems caused by a client asking for a very long DHE key.

Unfortunately, based on what I have seen, it seems like the DHE keysizes  
are hardcoded in many cases.

> Wan-Teh Chang
>
>
>>
>> Hmmm, wonder who made that decision...
>>
>>
>> Regardless, this is not a problem that will solve itself. Even if  
>> presenting
>> a longer key will cause a connection to abort in 0.1% of cases,  
>> browsers are
>> not going to make the attempt. So if nothing is done the legacy servers  
>> will
>> prevent use of longer DH keys for the next 20+ years.
>>
>> I don't think a TLS version number upgrade is the solution either. It is
>> just a bad idea for an algorithm suite identifier to mean one thing in  
>> TLS
>> 1.2 and another in TLS 1.3.
>>
>>
>> The simple solution to this problem in my view is to specify a new  
>> algorithm
>> suite identifier for DH larger than 1024 and use that in parallel. That
>> might get us to a point where 25% of Web Servers are using very strong  
>> EDH
>> within 12-24 months.
>>
>>
>> --
>> Website: http://hallambaker.com/
>>
>> _______________________________________________
>> TLS mailing list
>> TLS@ietf.org
>> https://www.ietf.org/mailman/listinfo/tls
>>
> _______________________________________________
> TLS mailing list
> TLS@ietf.org
> https://www.ietf.org/mailman/listinfo/tls

-- 
Sincerely,
Yngve N. Pettersen

Using Opera's mail client: http://www.opera.com/mail/