Re: [TLS] Broken browser behaviour with SCADA TLS

[[e-mail] (Martin Rex)]

Peter Gutmann <[e-mail]> wrote:
> David Benjamin <[e-mail]>? writes:
> 
>>The bad feedback was not even at a 2048-bit minimum, but a mere 1024-bit
>>minimum. (Chrome enabled far more DHE ciphers than others, so we encountered
>>a lot of this.) 2048-bit was completely hopeless. At the time of removal, 95%
>>of DHE negotiations made by Chrome used a 1024-bit minimum.
> 
> How does Google, rather than the people running the systems being connected
> to, know that 1024-bit DH isn't secure enough for a given environment?  The
> majority of this stuff is running on isolated, private networks or inside VPN
> tunnels for which pretty much anything, including 512-bit keys, are fine.

Silently removing stuff (support for TLS_DHE) is just as bad as silently
adding stuff (automatic, silent and unlimited-times protocol downgrade
dance in the broswer which became famously known as POODLE).


> 
> It's also somewhat disturbing that Chrome now walks straight past a perfectly
> good PFS DHE suite and instead goes to a problematic pure-RSA one instead.

Cough, what?  TLS_DHE_ was known to be a security disaster beyond fixing
a good decade ago (14-May-2007):

   https://www.ietf.org/mail-archive/web/tls/current/msg01647.html

but it needed a LOGJAM demonstration to have folks look at the
crappy implementations in the installed base.

We didn't have support for TLS_DHE in our SSL implementation back then,
and I decided I never want to have it added.  We've added support for
TLS_ECDHE a few years ago, but TLS_DHE remains unsupported.  Probably
most usage scenarios that still offer TLS_DHE today, provide less security
than with static-RSA 2048-bit.


How often does your SCADA devices (=servers) regenerate its DHE params?
If it is using DHparams for several weeks, months or even forever, then
there is essentially no PFS, and static RSA will be equal or better than DHE.
Static RSA-2048 will always be better than DHE-1024.  Simply regenerate
and roll your RSA keys&server cert if it makes you feel good.


btw. which kind of "problematic pure-RSA" are you talking of?
I'm not actually aware of any problem, and I'm much more concerned
about TLS servers with longterm DHE params or longterm ECDHE keys
and equally about servers using session tickets with a longterm session ticket
encryption key, because of the illusion of PFS, which they create but
do not offer.


-Martin