Re: [TLS] I-D Action: draft-ietf-tls-negotiated-ff-dhe-02.txt

[Henrick Hellström <[e-mail]>]

On 2014-10-27 13:10, Ilari Liusvaara wrote:
> One way (not necressarily good) would be to encode ServerDHParams as
> 00 01 00 NOT(grpid). If one tries to parse this as DHE, one gets p=0 and length
> of g being ~65,000 bytes (pretty certainly overflowing the message).

IMHO, a much better (and fully backwards compatible) way would be to 
deprecate the two explicit ECCurveTypes. A named_curve will start with 
03 xx xx  <1..2^8-1>, which cannot be parsed as legacy DHE without 
overflowing into the signature section and making the verification fail. 
Conversely, legacy DHE would have to contain a dh_p that is at least 
6144 bits in order for the ServerDHParams to start with 03, which would 
make it impossible for the signature to start at the right position for 
it to be verified by the ServerECDHParams parser.