Re: [TLS] DSA should die

On 4/1/2015 2:12 PM, Hanno Böck wrote:
> Hi,
>
> Mozilla just removed DSA support from Firefox. It seems the use of
> (non-ecc) DSA in TLS is pretty much nonexistent. Still the TLS 1.3 draft
> contains DSA.
>
> Proposal: DSA should go away and not be part of TLS 1.3.
To translate the above, its basically asking that DHE_DSS and DH_DSS be 
removed as key exchange mechanisms.

I've watched the discussion and mostly this is a don't care for me except:

This is a cipher suite issue and nothing else.   E.g. its an 
implementation decision rather than a protocol decision and vendors 
should be free to offer this if they think they have a market.  The rest 
of us should gleefully remove this from the set of cipher suites we 
offer or accept.

I would deprecate the older suites (e.g. anything less than <112 bits of 
strength) on general principles, but I would leave the choice whether or 
not to implement these to those who will charge what they need to charge 
when these are specified in RFPs as necessary.

So for the base question - no.   The section on DHE_DSS and DH_DSS in 
the TLS1.3 document should be unchanged from the TLS1.2 document AFAICT 
so there shouldn't be any additional work leaving it.

Mike

>
> Reasons to remove DSA:
> * DSA with 1024 bit is considered weak and DSA with more than 1024 bit
>    is widely unsupported.
> * DSA has comparable security to RSA (it using same keysize) which is
>    the de-facto-default. Given that everybody uses RSA and nobody uses
>    DSA having the latter only adds unneccessary complexity.
> * DSA can fail badly with bad random number generators.
>
> Some numbers:
> In the 2013 https ecosystem scan there were 17 DSA keys on public IPs,
> none of them CA-trusted:
> http://conferences.sigcomm.org/imc/2013/papers/imc257-durumericAemb.pdf
>
> I think it's safe to say nobody will care if DSA is removed.
>
> cu,
>
>
> _______________________________________________
> TLS mailing list
> TLS@ietf.org
> https://www.ietf.org/mailman/listinfo/tls