Re: [TLS] AD review of draft-ietf-tls-negotiated-ff-dhe-08

[Stephen Farrell <[e-mail]>]

Hiya,

On 01/04/15 05:27, Martin Rex wrote:
> Martin Thomson wrote:
>> Stephen Farrell <[e-mail]> wrote:
>>>
>>> #1 Have we tested in the wild that using elliptic_curves (10)
>>> in the ClientHello won't trigger some ECC code that causes
>>> handshakes to barf?
>>
>> Firefox sends the supported_curves extension in every handshake and so
>> do most browsers.  So for those, the risk of intolerance is obviously
>> quite low.  That's not hard numbers obviously, but that's a lot of
>> ClientHello messages with the extension.

Good stuff. But see below.

> 
> I think Stephen might have meant something else.
> 
> RFC4492 contains the following explicit prohibition (Section 4, 4th paragr.):
> 
>    https://tools.ietf.org/html/rfc4492#section-4
> 
> 
>    The client MUST NOT include these extensions in the ClientHello
>    message if it does not propose any ECC cipher suites. 

Ooh - good catch, I hadn't spotted that. This draft is updating 4492
though so we can validly change that, but if we're doing so (and I
guess we are) then it'd be better to be very explicit about it, e.g.
by adding a sentence saying that we're changing that specific MUST NOT.

> and the above requirement seems to prohibit a non-ECC client from
> using the named FFDHE parameters through the ECC named curve extension
> _without_ accompanying ECC cipher suites.

Right. That's the kind of thing I was wondering about.

I'll happily accept the wg's word on this, but to what extent have
we checked that we're not breaking something with this change in
semantics. (It's a small, but real, change.)

Thanks,
S.


> 
> 
> -Martin
>