Re: [TLS] Still missing: TLS_ECDH_anon_WITH_AES_xxx_GCM_SHAxxx

[[e-mail] (Martin Rex)]

I strongly frown upon the idea of resurrecting DH_anon cipher suites
from their cold grave, let alone adding new cruft.

Generate Server Keys on the fly just like SSH does.  Resurrecting
DH_anon turns an initial-leap-of-faith into eternal-leaps-of-faith.

-Martin


Yaron Sheffer wrote:
> 
> this is about much more than anon-DH cipher suites. The proposal that if 
> the client doesn't see a DANE certificate, it can initiate a TLS 
> connection with (only) anon-DH means that even if the server does have a 
> PKIX certificate (maybe it's old and has not heard of TLSA yet:-), the 
> client will not be able to get an authenticated connection with it. So 
> we will probably need these cipher suites combined with additional TLS 
> signaling, as well as certificate pinning, to allow clients to juggle 
> securely between authenticated and anonymous TLS.
> 
> Thanks,
> 	Yaron
> 
> On 03/13/2014 07:02 AM, Nico Williams wrote:
> [...]
> 
> >
> > In the SMTP case when there's no TLSA RRs in the DNS for the server
> > and the server has no certificates, the client may prefer to use anon
> > DH/ECDH.  Considering that e-mail has historically had very poor
> > privacy protection, that would be a huge step up.  But today an SMTP
> > client can't get high-performance ECDH and AEAD ciphers :(