Re: [TLS] DHE key derivation

[Hanno Böck <[e-mail]>]

On Fri, 27 Sep 2013 18:07:42 +0300
Yaron Sheffer <[e-mail]> wrote:

> While we're opening (maybe) the negotiation of DHE, I'd like to
> clarify an issue that bothers me in the implementation of DHE in TLS:
> 
> With DHE, the premaster secret depends only on the DH shared secret.
> We know that DHE is commonly used with 1024-bit parameters. So even
> if you have a 2048-bit RSA certificate, the session strength will be
> 1024 bits.
> 
> What if we mixed *both* the DH secret and the regular encrypted nonce 
> that's used in RSA ciphersuites into the premaster secret? Wouldn't
> we get forward secrecy, as well as crypto strength equivalent to the
> higher of the two lengths?

I feel this would add even more confusion.

What you'd get:
- Connection Security of the RSA key size, BUT
- Forward Secrecy only with the security of the DHE modulus size

Or to be concrete: an attacker able to steal the certificate's key
AFTER recording a connection and at the same time being able to break
the DHE would still be able to decrypt.

I don't really get why that should make any sense. Okay, it would avoid
that DHE "downgrades" the security of the RSA key.
But: This would require changes to the protocol. Won't work with
existing software, so it won't solve the mess we have today.

If you are already changing the protocol, you can also do something
that makes much more sense: Forbid DHE modulus size smaller than RSA
key size. (which also could be achieved just by server policy without
protocol changes, but then breaks messy clients like java - see past
discussion)

-- 
Hanno Böck
http://hboeck.de/

mail/jabber: [e-mail]
GPG: BBB51E42