[TLS] New Algorithm identifier for EDH > 1024 bits?

[Phillip Hallam-Baker <[e-mail]>]

My understanding of the 1024 bit Ephemeral DH key issue is that it is not
currently possible to use longer keys because a certain number of deployed
Web servers will abort the connection if a client presents a longer key.

Hmmm, wonder who made that decision...


Regardless, this is not a problem that will solve itself. Even if
presenting a longer key will cause a connection to abort in 0.1% of cases,
browsers are not going to make the attempt. So if nothing is done the
legacy servers will prevent use of longer DH keys for the next 20+ years.

I don't think a TLS version number upgrade is the solution either. It is
just a bad idea for an algorithm suite identifier to mean one thing in TLS
1.2 and another in TLS 1.3.


The simple solution to this problem in my view is to specify a new
algorithm suite identifier for DH larger than 1024 and use that in
parallel. That might get us to a point where 25% of Web Servers are using
very strong EDH within 12-24 months.


-- 
Website: http://hallambaker.com/