Re: [TLS] False Start, DHE key exchange, and the Negotiated FF-DHE extension

[Daniel Kahn Gillmor <[e-mail]>]

On 12/16/2014 12:45 AM, Brian Smith wrote:

> The MitM may have tampered with or removed the FFDHE groups from the
> extension in the ClientHello, misleading the server into thinking the
> client's capabilities are weaker than they actually are, and thus
> causing the server to choose weaker DHE parameters. The tampering will
> be detected by the server when it validates the Client's Finished
> message, but by that time the client will have already sent data
> encrypted with keys derived from the weak DHE key material.
> 
>> Perhaps the false start draft should say that a client shouldn't do
>> false start for a server that offers FFDHE but does not send an
>> acceptable named group.
> 
> I agree that the client could maintain a whitelist of
> false-start-acceptable FFDHE groups, which should be a subset of the
> FFDHE groups listed in its supported curves extension. However,
> wording to that effect, and wording about how to compare the strength
> of ECDHE groups to FFDHE groups, should be included in the draft if
> FFDHE support is going to continue to be recommended. IMO, FFDHE is
> basically obsolete now, so it isn't worth the effort to do this.
> However, I understand that others might disagree.

I've modified the ffdhe draft (as of -05) to include this guidance.

https://tools.ietf.org/html/draft-ietf-tls-negotiated-ff-dhe-05

	--dkg