Re: [TLS] Consensus Call for acceptance of draft-gillmor-tls-negotiated-dl-dhe-02

[Nikos Mavrogiannopoulos <[e-mail]>]

On Mon, 2014-06-23 at 21:19 -0700, Watson Ladd wrote:
> Dear all,
> 
> I'm very undecided about this proposal. While it does solve a security
> issue in TLS, so does disabling DHE in favor of ECDH. It's likely that
> this extension will not be widely deployed, and DHE without the
> extension is insecure. I think we run the risk of implementations
> supporting DHE, ostensibly with the extension, but in practice still
> vulnerable to Triple DH. Given the performance disadvantages of DHE
> compared with ECDH, I don't really see a benefit to supporting it,
> given that legacy implementations will not support this extension.

The disadvantage of what you propose is that we stick with ECDHE, and on
the first vulnerability known for the ECDHE ciphersuites we have no
alternative to fall back (note that the proposal solves a compatibility
issue of the DHE ciphersuites, it is not solely a security enhancement
as you imply - see the abstract and introduction).

regards,
Nikos