Re: [TLS] Consensus Call for acceptance of draft-gillmor-tls-negotiated-dl-dhe-02

[Tapio Sokura <[e-mail]>]

Hello,

On 23.6.2014 8:27, Joseph Salowey (jsalowey) wrote:
> The chairs would like to get the sense of the WG on adopting
> as a WG document:
> 
> http://tools.ietf.org/html/draft-gillmor-tls-negotiated-dl-dhe-02

Looks good, I support this.

A small editorial note, the middle of section 1.2 should include the
abbreviation ECDHE immediately in the sentence where it is spelled out,
for example "TLS also supports elliptic-curve-based Diffie Hellman
ephemeral (ECDHE) key exchanges, but this document does not discuss
their use."

My layman view on section 5.1 is that I don't think the server needs to
indicate it's support of named DHE groups if the negotiated ciphersuite
doesn't use them. The client should not make any conclusions about the
support of named DHE groups on the server now or in the future, if the
server chooses a non-DHE group. Consequently the client should always
include the extension on every ClientHello, if the client is willing to
use those groups.

A good thing in including a 1024 DHE group (section 5.2) in the named
group list would be that the client would not need to verify that the
group parameters are secure when using a small group. But then again a
modern server or client that comes to support this extension will with
very high probability support the stronger groups anyway, so I don't
think there is a need for weak groups in the spec. If we think of the
strengths of the groups in the draft, 112-125-150-175-192 bits, do we
even need the 2432 bit group, it's so close to a 3072 bit group?

  Tapio