Re: [TLS] Negotiated Discrete Log DHE revision [was: Re: Confirming Consensus on removing RSA key Transport from TLS 1.3]

[Daniel Kahn Gillmor <[e-mail]>]

On 04/08/2014 12:53 PM, Michael D'Errico wrote:
> There is already a list of DH groups managed by the IANA for IKE that was
> established by RFC 2409 and includes the MODP groups from RFC 3526 plus
> others.  Why not just use this existing registry and add your new e-based
> groups to it?

I tried to address this question in section 8.4 of the current draft:

https://tools.ietf.org/html/draft-gillmor-tls-negotiated-dl-dhe-01#section-8.4

-----------------
8.4.  Choice of groups

   Other lists of named discrete log Diffie-Hellman groups
   [STRONGSWAN-IKE] exist.  This draft chooses to not reuse them for
   several reasons:

      Using the same groups in multiple protocols increases the value
      for an attacker with the resources to crack any single group.

      The IKE groups include weak groups like MODP768 which are
      unacceptable for secure TLS traffic.

      Mixing group parameters across multiple implementations leaves
      open the possibility of some sort of cross-protocol attack.  This
      shouldn't be relevant for ephemeral scenarios, and even with non-
      ephemeral keying, services shouldn't share keys; however, using
      different groups avoids these failure modes entirely.

      Other lists of named DL DHE groups are not collected in a single
      IANA registry, or are mixed with non-DL DHE groups, which makes
      them inconvenient for re-use in a TLS DHE key exchange context.
-----------------

Do you find these arguments unconvincing, or do you have suggestions for
how the text should be changed?

	--dkg