Re: [TLS] I-D Action: draft-ietf-tls-negotiated-ff-dhe-02.txt

[Henrick Hellström <[e-mail]>]

On 2014-10-27 12:07, Nikos Mavrogiannopoulos wrote:
> We may be referring to different versions of the draft. The current
> draft says:
> "If the extension is present, none of the client's offered groups are
>     acceptable by the server, and none of the client's proposed non-FFDHE
>     ciphersuites are acceptable to the server, the server SHOULD end the
>     connection with a fatal TLS alert of type insufficient_security."
>
> This does explicitly prohibit the server to negotiate an FFDHE cipher
> suite if the extension is present.

OK, I stand corrected, I didn't interpret that paragraph that way. It 
starts with

>    If a compatible TLS server receives a NamedCurves extension from a
>    client that includes any FFDHE groups


...so I interpreted the whole paragraph as referring to extensions the 
server is able to recognize as including BOTH named elliptic curves AND 
named ffdhe groups. If it really says that a Named FFDHE compatible 
server MUST NOT negotiate DHE cipher suites with clients that implement 
RFC 4492, but not the Named FFDHE standard, that should be stated 
explicitly.

It does however strike me as odd that, as a consequence, a named FFDHE 
compatible server, would still be allowed to negotiate DHE cipher suites 
with legacy clients that do not even implement RFC 4492, but not with 
legacy clients that implement DHE in the exact same way, but also 
support a few weak elliptic curves.