Re: [TLS] False Start, DHE key exchange, and the Negotiated FF-DHE extension

[Brian Smith <[e-mail]>]

Daniel Kahn Gillmor <[e-mail]> wrote:
> I've modified the ffdhe draft (as of -05) to include this guidance.
>
> https://tools.ietf.org/html/draft-ietf-tls-negotiated-ff-dhe-05

This looks good. However, I think this text actually belongs in
draft-bmoeller-tls-falsestart, not draft-ietf-tls-negotiated-ff-dhe,
because (a) it applies even when the negotiated ff-dhe mechanism isn't
being used, (b) there are other tamperings besides ff-dhe that can
cause a downgrade in DHE strength, and (c) I think it is best to keep
all the false start stuff together when practical.

I think you can drop "and MUST offer at least one of these in the
initial handshake if they contemplate using the False Start protocol
modification." What the client actually offers doesn't matter as far
as False Start security is concerned; the only thing that matters is
what the server receives.

I think implementers will need more help in determining what is
"cryptographically strong," such as a suggested minimum key sizes and
suggested countermeasures against exploits targetting servers
misconfigured in a way that would permit small subgroup attacks or
other weak keys. For example, the recommendation could be to only do
false start when the server uses parameters in the FF-DHE registry,
which addresses both small keys and small subgroup attacks.

I think that some mention of the attacker controlling the choice of
ECDHE vs FF-DHE is also worth mentioning.

Cheers,
Brian