Re: [TLS] draft-sheffer-tls-bcp: DH recommendations

[[e-mail] (Martin Rex)]

Yaron Sheffer wrote:
> 
> But new extensions are out of scope for draft-sheffer-tls-bcp. We need a 
> set of best common practices that people can actually deploy within the 
> coming year, hopefully earlier.


Personally, I believe that the cipher suites currently listed
in the document are *FAR* from realistic.

They're based on _several_ flawed assumptions:
  1) that optional EC crypto is available in deployed implementations
  2) that optional TLSv1.2 is available in deployed implementations
  3) that optional AES-GCM is available in deployed implementations
  4) that TLS clients universally have re-connect fallbacks to
     cope with TLS servers that are TLSv1.2-intolerant.

For a huge number of communication scenarios, all 4 of this list
apply only to one side, for a non-marginal, all 4 of this apply
to neither side.

Please do not underestimate problem (4).  There are currently
SSL accellerators sold (and widely used) that are limited to
TLSv1.0 and will abort connections when ClientHello contains
TLSv1.1 or TLSv1.2.  This year, the fiscal authority of Portugal (IRS)
launched Web-Services scenarios, where such TLSv1.2-intolerant
SSL Accelerators are being used in production.

What I really would appreciate is a recommendation that works
in the real world, providing a path forward that is realistic
to get added through a software update to *EXISTING* implementations,
which clearly rules out all 4 on the above list.

-Martin