Re: [TLS] TLS 1.2 draft

Martin Rex <martin.rex@sap.com> writes:

> EKR wrote:
>> 
>> Martin Rex <martin.rex@sap.com> writes:
>> 
>> > EKR wrote:
>> >> 
>> >>      - Remove ephemeral RSA [issue 3]
>> >
>> > This makes me sad.
>> >
>> > I would have SIGNIFICANTLY preferred if temporary/ephemeral RSA
>> > had been retained and the restriction to the RSA_EXPORT ciphersuites
>> > had been removed instead.
>> >
>> > As I had previously explained, the use of temporary/ephemeral RSA
>> > with same-strength keys as the server's certificate would make
>> > key-stealing of the servers' key much less useful for passive
>> > attacks.
>> 
>> The recommendation is to use RSA/DHE for these applications. Can
>> you explain why you think ephemeral RSA is superior?
>
> The Server's RSA key is typically used for at least one year
> (or longer if renewal just extends the cert lifetime and keeps
>  the key/keypair).
>
> If an attacker gets hold of the Servers private RSA key, he can
> passively monitor (decrypt) all sessions using a RSA-based ciphersuite.
>
> When a temporary/ephemeral keypair is used for key exchange, then
> possession of the private RSA key will not be sufficient to
> passively monitor (decrypt) SSL sessions with the server
> using an RSA ciphersuite with a temporary/ephemeral keypair.
> It will require an active (MITM) attack.

Right. I understand this point.

What I'm saying is that the recommendation to prevent his attack
is to use an RSA_DHE ciphersuite and use a fresh DH ephemeral
with each key exchange. This provides the same security at
a substantially superior performance level.

-Ekr

_______________________________________________
TLS mailing list
TLS@lists.ietf.org
https://www1.ietf.org/mailman/listinfo/tls