Re: [TLS] AD review of draft-ietf-tls-negotiated-ff-dhe-08

[Daniel Kahn Gillmor <[e-mail]>]

Hi all--

Thanks to Stephen and both Martins for the review.

On Wed 2015-04-01 05:42:07 -0400, Stephen Farrell wrote:
> On 01/04/15 05:27, Martin Rex wrote:
>> I think Stephen might have meant something else.
>> 
>> RFC4492 contains the following explicit prohibition (Section 4, 4th paragr.):
>> 
>>    https://tools.ietf.org/html/rfc4492#section-4
>> 
>>    The client MUST NOT include these extensions in the ClientHello
>>    message if it does not propose any ECC cipher suites. 
>
> Ooh - good catch, I hadn't spotted that. This draft is updating 4492
> though so we can validly change that, but if we're doing so (and I
> guess we are) then it'd be better to be very explicit about it, e.g.
> by adding a sentence saying that we're changing that specific MUST NOT.

I'd be happy to add a sentence to the draft clarifying this point.  If
anyone wants to propose concrete text i'm happy to use it, or i'll try
to come up with something short and sweet.

>> and the above requirement seems to prohibit a non-ECC client from
>> using the named FFDHE parameters through the ECC named curve extension
>> _without_ accompanying ECC cipher suites.
>
> Right. That's the kind of thing I was wondering about.
>
> I'll happily accept the wg's word on this, but to what extent have
> we checked that we're not breaking something with this change in
> semantics. (It's a small, but real, change.)

In practice, i've yet to find a TLS server that chokes when offered
these extensions without any ECC cipher suites.

GnuTLS as a client does not follow this MUST.  You can try it yourself
to connect to any server with something from the 3.x line:

 gnutls-cli --priority NORMAL:-ECDHE-RSA:-ECDHE-ECDSA $SERVER

looking with wireshark, you'll see that there are no ECC ciphersuites,
but the groups and point formats extensions are sent anyway.

I haven't done a full zmap scan of the full ipv4 space, but i've tested
many systems and have not found any servers that abort just because
these extensions are present without an ECC ciphersuite.

      --dkg