IETF Logo Mail Archive

Re: [TLS] DHE key derivation

Michael D'Errico <mike-list@pobox.com> Fri, 27 September 2013 16:19 UTC

Return-Path: <mike-list@pobox.com>
X-Original-To: tls@ietfa.amsl.com
Delivered-To: tls@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5EF7F21F9A57 for <tls@ietfa.amsl.com>; Fri, 27 Sep 2013 09:19:15 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.577
X-Spam-Level:
X-Spam-Status: No, score=-2.577 tagged_above=-999 required=5 tests=[AWL=0.022, BAYES_00=-2.599]
Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id uC0qHATYCsP4 for <tls@ietfa.amsl.com>; Fri, 27 Sep 2013 09:19:10 -0700 (PDT)
Received: from sasl.smtp.pobox.com (a-pb-sasl-quonix.pobox.com [208.72.237.25]) by ietfa.amsl.com (Postfix) with ESMTP id D891C21F9ADD for <tls@ietf.org>; Fri, 27 Sep 2013 09:19:09 -0700 (PDT)
Received: from sasl.smtp.pobox.com (unknown [127.0.0.1]) by a-pb-sasl-quonix.pobox.com (Postfix) with ESMTP id E3770DE06; Fri, 27 Sep 2013 12:19:08 -0400 (EDT)
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed; d=pobox.com; h=message-id :date:from:mime-version:to:cc:subject:references:in-reply-to :content-type:content-transfer-encoding; s=sasl; bh=5k49+22qL4DC 9o3z7MFqqztu2mo=; b=vMlO9nUh/rhSwbogF+NljAsjFkinxsk2UTDYD6wC34Lt Mau567ZMEd/jJNvxtcG+L2W0wN/Wj7zBEGayVPbpnb7XMDA1wV6Qb2Jt3gzza1bm Y3kPU0oRgFt5dEIOrbITbkiBSNQgj+1uEtreAQEjbIacNF6i2wzVWa3GvE7/pZo=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=pobox.com; h=message-id:date :from:mime-version:to:cc:subject:references:in-reply-to :content-type:content-transfer-encoding; q=dns; s=sasl; b=WoNK1p UszxRZIL8TGSn1I0fx7fqe4JAzNXe/E6cjBXtfz6gmrIY3ECGC2RIrnSurE/0LxM xEv67DXgPub7NkawHCwl2c3/O9N5XpbOaVO6fldZjyOOIFDL0FQmB1wzCmGdOtl+ teo4NvtH0yu0j5aX5XUiRBlqUybjKAiJbrUNw=
Received: from a-pb-sasl-quonix.pobox.com (unknown [127.0.0.1]) by a-pb-sasl-quonix.pobox.com (Postfix) with ESMTP id DC0CFDE05; Fri, 27 Sep 2013 12:19:08 -0400 (EDT)
Received: from iMac.local (unknown [24.234.153.62]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by a-pb-sasl-quonix.pobox.com (Postfix) with ESMTPSA id CF6D6DE03; Fri, 27 Sep 2013 12:19:03 -0400 (EDT)
Message-ID: <5245AFF7.5020903@pobox.com>
Date: Fri, 27 Sep 2013 09:19:03 -0700
From: Michael D'Errico <mike-list@pobox.com>
User-Agent: Thunderbird 2.0.0.24 (Macintosh/20100228)
MIME-Version: 1.0
To: mrex@sap.com
References: <20130927153439.54C8A1A9B4@ld9781.wdf.sap.corp>
In-Reply-To: <20130927153439.54C8A1A9B4@ld9781.wdf.sap.corp>
Content-Type: text/plain; charset="ISO-8859-1"; format="flowed"
Content-Transfer-Encoding: 7bit
X-Pobox-Relay-ID: 86B7CBAE-2790-11E3-9801-CE710E5B5709-38729857!a-pb-sasl-quonix.pobox.com
Cc: tls@ietf.org
Subject: Re: [TLS] DHE key derivation
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/tls>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 27 Sep 2013 16:19:15 -0000

Martin Rex wrote:
>> It is not recommended to use the same RSA key for both signing and
>> key encipherment.
> 
> Isn't that (using the same RSA key for both signing and key encipherment)
> what pretty much all TLS Servers do when they support both,
> traditional RSA ciphersuites plus DHE_RSA and/or ECDHE_RSA?

I believe that many servers do use the same key for both, though
they don't have to.  This practice is likely due to cost (buy one
certificate instead of two) and software limitations.

Mike

v2.23.0 | Report a Bug | By Email