Re: [TLS] security levels for TLS

> Note that the server can already maintain multiple keys and choose one
> based on the cipher suite. It's merely that the client can't *directly*
> request specific asymmetric key sizes for DH and RSA.

I'm proposing an extremely simple way to let the client directly
request the desired key sizes.  Isn't that better than hoping that
the server replies with an acceptable key?

>> Negatives:
>>
>>    - effort is needed to write a specification and approve it
>>    - a server may not support the extension, so a client may
>>      have to implement an inefficient renegotiation scheme in
>>      addition anyway
> 
> - It encourages an inappropriate focus on key size. As I said already,
>   There's a lot more to security than key size.

But key size -is- a big part of it, and you should be able to tell
a server what key sizes you want, rather than leave it up to chance.

Let me express this in a different way:

Imagine if TLS already had the ability for a client to specify key
sizes to the server, and I was arguing to get rid of that.  Wouldn't
you think I was crazy for suggesting it?

> - It adds yet more unnecessary complexity to a spec which is already
>   quite complicated. 

I'm aware of how complicated it is.  I'm in the process of trying
to add support for some of the existing extensions such as the
trusted CA indication, and the complexity of that is so much more.

> - It's yet another way to have interop problems.

Isn't every addition?

> - Implementations which want DH key sizes significantly greater than
>   1024 would be better served to move to EC, which already has
>   explicit support for communicating which groups are supported.

And pay someone for the right to generate a self-signed certificate?
If you can do it with EC, why do you argue against doing it for DHE?

>>    - Eric doesn't like it ;-)
> 
> I don't see you getting a lot of support from others, either.

I find myself in this position occasionally, and accept that most
people will stay out of the line of fire.

Mike

_______________________________________________
TLS mailing list
TLS@lists.ietf.org
https://www1.ietf.org/mailman/listinfo/tls