Re: [TLS] draft-sheffer-tls-bcp: DH recommendations

[Patrick Pelletier <[e-mail]>]

On 9/21/13 9:42 AM, Michael D'Errico wrote:

> The problem is that there apparently is lots of TLS code which can only
> handle
> 1024-bit DH parameters and would break if a server sent larger parameters.

Doesn't this "lots of TLS code" boil down to just Java?  That's the only 
implementation I've heard of that supports DHE_RSA but chokes on 2048 
DH.  Is there another?

My understanding of the Windows (SChannel) situation is that Windows has 
a limit of 1024 for DHE_DSS, but doesn't support DHE_RSA at all. 
Although it's unfortunate in some ways that it doesn't support DHE_RSA, 
it's actually a good thing in disguise, since it means that the cipher 
suite negotiation will take care of the problem.

> Remember that this is an Engineering group (the "E" in IETF) which has
> to keep
> the Internet working while we attempt to improve security for everyone.
> If we
> knew how to move to 2048 bits without breaking anything we would.

We *do* know how to move to 2048 bits without breaking anything: add an 
extension to negotiate DH size, just like how ECC curves are negotiated. 
  Although yes, this will take a while to deploy universally, it at 
least means early adopters can start using 2048 now, without breaking 
the stragglers like Java.

(I'd rather just leave Java in the dust and switch to 2048 now.  But if 
we really want to avoid breaking Java, this is how to do it.)

--Patrick