[TLS] Review of draft-dugal-tls-ecmqv-00

1. It would be nice somewhere around sections 1-2 to have an overview
of the inputs to ECMQV. In particular, the requirement for 
the client to have two key pairs--one of which is always
ephemeral--is sufficiently different from classic DH that
it makes sense to review here.

As usual, it would be nice to have some kind of ladder diagram
that summarizes the exchanges at an abstract level.

S 3.
As a practical matter, how likely is it that client and server
will share a group?

S 4.1.
What about DSA-signed certificates?

S 4.2.
As I understand this scheme, the ECMQV-capable ECDSA key in
the certificate is used to sign the server's ephemeral
ECMQV key. Unless I'm missing something, there's no security
reason why the server's static key needs to be an EC key
at all. It could just as well be an RSA key. True, the
server needs to communicate the group that the ephemeral
key is generated in but that could be sent in the ServerKeyExchange,
as in TLS/ECC. Have I missed something?

You write:

   The client retrieves the server's ephemeral ECMQV public key from the
   ServerKeyExchange message.

Probably worth mentioning that it needs to verify the SKE.

S 4.6.
Nit:    "demonstrate it's control". Should be "its"
Same error in 4.7.

_______________________________________________
TLS mailing list
TLS@lists.ietf.org
https://www1.ietf.org/mailman/listinfo/tls