From: Peter Gutmann <pgut001@cs.auckland.ac.nz>
To: Bodo Moeller <bmoeller@acm.org>, "tls@ietf.org" <tls@ietf.org>
Thread-Topic: [TLS] RFC 7919 on Negotiated Finite Field Diffie-Hellman
 Ephemeral Parameters for Transport Layer Security (TLS)
Thread-Index: AdH3qzVttHomztzDTIKlIRH23NqfIv//fPYAgAIjA03//486AIADpKzA
Date: Fri, 19 Aug 2016 12:29:23 +0000
Message-ID: <9A043F3CF02CD34C8E74AC1594475C73F4CF416C@uxcn10-5.UoA.auckland.ac.nz>
References: <9A043F3CF02CD34C8E74AC1594475C73F4CF009C@uxcn10-5.UoA.auckland.ac.nz>
 <20160816145548.GQ4670@mournblade.imrryr.org>
 <9A043F3CF02CD34C8E74AC1594475C73F4CF1AC9@uxcn10-5.UoA.auckland.ac.nz>,
 <CADMpkc+vbkWz_TQ2Ch5JfaVRPse4qeXPPitsBV=d2yDtSx4eLA@mail.gmail.com>
In-Reply-To: <CADMpkc+vbkWz_TQ2Ch5JfaVRPse4qeXPPitsBV=d2yDtSx4eLA@mail.gmail.com>
Accept-Language: en-NZ, en-GB, en-US
Content-Language: en-NZ
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
Archived-At: <https://mailarchive.ietf.org/arch/msg/tls/APAY84m_uZodC5lwTZALJPD6-qU>
Subject: Re: [TLS] RFC 7919 on Negotiated Finite Field Diffie-Hellman
 Ephemeral Parameters for Transport Layer Security (TLS)
Precedence: list

Bodo Moeller <bmoeller@acm.org> writes:=0A=
=0A=
>Peter, so your complaint is about the lack of support for explicitly=0A=
>specified (non-"named") groups?=0A=
=0A=
It's the lack of support for DHE unless it's the exact parameters the serve=
r=0A=
wants.  At the moment if your implementation wants to use DHE (which pretty=
=0A=
much all of them do) you have two options:=0A=
=0A=
1. Ignore RFC 7919 and perform DHE with several billion devices worldwide.=
=0A=
=0A=
2. Implement RFC 7919 and, unless both client and server happen to choose a=
n=0A=
   appropriate FFDHE parameter set that both sides can agree on, be forced =
to=0A=
   fall back to the old, unsafe RSA key exchange.=0A=
=0A=
The problem is that 7919 doesn't say "I want to do DHE, if possible with th=
ese=0A=
parameters", it says "I will only accept DHE if you use these parameters,=
=0A=
otherwise you cannot use DHE but must drop back to RSA".  Talk about cuttin=
g=0A=
off your nose to spite your face, you'd have to have rocks in your head to=
=0A=
want to break your implementation like that.=0A=
=0A=
Until now I hadn't had a major interest in 7919 (it's rather hard to identi=
fy=0A=
what problem it's actually solving), but thought I'd look at it for TLS-LTS=
=0A=
use.  However, if using it requires giving up DHE in a lot of cases there's=
 no=0A=
way I'll be implementing it.=0A=
=0A=
Peter.=