Re: [TLS] AD review of draft-ietf-tls-negotiated-ff-dhe-08

On 03/04/15 21:31, Daniel Kahn Gillmor wrote:
> On Fri 2015-04-03 13:54:37 -0400, Stephen Farrell wrote:
>> On 03/04/15 15:22, Sean Turner wrote:
>>> On Mar 31, 2015, at 19:56, Stephen Farrell
>>> <stephen.farrell@cs.tcd.ie> wrote:
>>>
>>>> #2 I've never quite gotten the reasoning behind not giving any
>>>> names to any of the RFC3526 curves and I think that question
>>>> deserves an answer (to be in the list archive). So - why not?
>>>
>>> Maybe I’m not following but are you asking that we retroactively name
>>> the "4096-bit MODP Group”?
>>
>> Right, that and any others we still like. The thought is that
>> we might get a minor security benefit if the client says that
>> they're ok with e.g. the 2048-bit MODP group thereby causing
>> some server to not try use a custom group or the old smaller
>> groups. (I mean that'd be a minor benefit compared to the
>> current situation, not compared to what the draft proposes.)
>>
>> It's not a major thing as the client can still just check for
>> the RFC3626 groups but I'm not sure how likely it is that'd
>> be done. OTOH, anyone who updates their code to handle this
>> can just as easily adopt the new groups, and I don't think
>> there's any particular benefit to sticking with the RFC3526
>> groups (e.g. there's no dedicated h/w for those I think).
>>
>> So if the answer is "yeah, we considered that and didn't like
>> it because <foo>" that's fine, I just don't recall having seen
>> it on the list.
> 
> There are two concrete (and related) answers in the draft as to why
> we're not importing several pre-existing named groups:
> 
>  https://tools.ietf.org/html/draft-ietf-tls-negotiated-ff-dhe-08#section-9.5
>  https://tools.ietf.org/html/draft-ietf-tls-negotiated-ff-dhe-08#section-10.1
> 
> Please let me know if there are any changes that could be made to make
> the situation more clear, or if you disagree with the rationales.

It's not that I disagree with 'em, but I don't find them
that compelling tbh. The best (to me) seems to be that
additional usage in multiple protocols makes for a more
attractive target. But the MODP groups are already used
in TLS, and naming them in this way might reduce the
liklihood that some implementation accepts groups without
checking 'em. (E.g. an updated client would have the code
to check that a known-named group has been selected by
the server, so might benefit even if the server hasn't
been updated).

However, let's proceed and please treat the above as just
another last call comment. In this case, you've responded
already so if nobody else wants to pursue the discussion
then we'll be all set.

S.

> 
>     --dkg
> 
> _______________________________________________
> TLS mailing list
> TLS@ietf.org
> https://www.ietf.org/mailman/listinfo/tls
> 