Re: [TLS] Re: Russ Housley: Fwd: problems with

Martin Rex <martin.rex@sap.com> writes:

> Eric Rescorla wrote:
>> 
>> >> In particular, this advice does not match with current TLS practice,
>> >> which is NOT to check for weak keys.
>> >
>> > It is a security consideration, and I present it for consideration as
>> > such.  Let's consider the (admittedly unlikely, but also admittedly
>> > possible) case of DES with an all-zero key, or 3DES with an all-zero
>> > key.  Surprise!  Identity operation!  Would you want /your/ medical or
>> > financial data protected over a network that had implementations that
>> > could possibly not encrypt it at all?
>> 
>> Yes, I'm quite familiar with the issue. And yes, I'm quite comfortable
>> with the current situation.
>
> Although the existing SSL/TLS specs do not define how to synchronously
> skip/drop weak keys during key generation upfront and synchronously,
> wouldn't it be possible for either side (when the particular implementations
> feels such a need) to detect a weak key and force the peer directly
> through a renegotiate -- even old peers?

Sure. Except that the other side can refuse to renegotiate and
that there are deadlock conditions if you try to renegotiate
at the wrong time....

-Ekr

_______________________________________________
TLS mailing list
TLS@lists.ietf.org
https://www1.ietf.org/mailman/listinfo/tls