Re: [TLS] RFC 7919 on Negotiated Finite Field Diffie-Hellman Ephemeral Parameters for Transport Layer Security (TLS)

Geoffrey Keating <geoffk@geoffk.org> Wed, 17 August 2016 21:47 UTC

Return-Path: <geoffk@geoffk.org>
X-Original-To: tls@ietfa.amsl.com
Delivered-To: tls@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2FC0212D7A3 for <tls@ietfa.amsl.com>; Wed, 17 Aug 2016 14:47:38 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.901
X-Spam-Level:
X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 7dhtaBKtei92 for <tls@ietfa.amsl.com>; Wed, 17 Aug 2016 14:47:35 -0700 (PDT)
Received: from dragaera.releasedominatrix.com (dragaera.releasedominatrix.com [198.0.208.83]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E885212D7A0 for <tls@ietf.org>; Wed, 17 Aug 2016 14:47:35 -0700 (PDT)
Received: by dragaera.releasedominatrix.com (Postfix, from userid 501) id 95B5033D213; Wed, 17 Aug 2016 21:47:35 +0000 (UTC)
Sender: geoffk@localhost.localdomain
To: Peter Gutmann <pgut001@cs.auckland.ac.nz>
References: <9A043F3CF02CD34C8E74AC1594475C73F4CF009C@uxcn10-5.UoA.auckland.ac.nz> <20160816145548.GQ4670@mournblade.imrryr.org> <9A043F3CF02CD34C8E74AC1594475C73F4CF1AC9@uxcn10-5.UoA.auckland.ac.nz>
From: Geoffrey Keating <geoffk@geoffk.org>
Date: 17 Aug 2016 14:47:35 -0700
In-Reply-To: <9A043F3CF02CD34C8E74AC1594475C73F4CF1AC9@uxcn10-5.UoA.auckland.ac.nz>
Message-ID: <m2a8gboyo8.fsf@localhost.localdomain>
Lines: 16
User-Agent: Gnus/5.09 (Gnus v5.9.0) Emacs/21.4
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Archived-At: <https://mailarchive.ietf.org/arch/msg/tls/BbHelJzpSSkyTokfW1h3PlqmvFA>
Cc: "tls@ietf.org" <tls@ietf.org>
Subject: Re: [TLS] RFC 7919 on Negotiated Finite Field Diffie-Hellman Ephemeral Parameters for Transport Layer Security (TLS)
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.17
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/tls/>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 17 Aug 2016 21:47:38 -0000

Peter Gutmann <pgut001@cs.auckland.ac.nz> writes:

> Viktor Dukhovni <ietf-dane@dukhovni.org> writes:
> 
> >There's no guess, the client sends its full list of supported
> >groups, and the server picks the one it likes.
> 
> ... and if the client doesn't get it exactly right, the server has to fall
> back to RSA rather than use another DHE suite of its choosing.

I believe that's the intention; the assumption is that the client
using this extension doesn't want DHE parameters that it doesn't have
configured, it only wants one of a pre-validated list of
groups/generators.  It especially doesn't want the server to say
"well, I know the client listed only groups 2048-bit and higher, but I
have this 512-bit group, let's use that".