[TLS] key sizes in TLS.

["Dang, Quynh" <[e-mail]>]

Currently (as I understand it), client has no mechanism (or extension) to let the server know what DH-sizes are acceptable (for security reason) when doing DH-RSA and DH-DSS key exchanges and what RSA and DSS key sizes are acceptable for server authentication.

Also, there is no extension or mechanism for which the server can tell the client which key sizes it will accept for client's authentication (in a certificate request the server can tell the client which algorithm(s) it would accept for the client's authentication, but not key sizes).

If I understand it correctly, the client just generates DH parameters comparable with the DH parameters, which the client receives from the server. (I suppose the client could terminate the connection using its local policy when the DH parameters don't meet its security strength requirement). So, I guess it would be nice if the client could let the server know what key size(s) will be acceptable to the client.


I don’t know if it would make sense to specify (1) a method for which the client can use to let the server know what key size(s) (DSS or RSA and DH) are acceptable and (2) a method for which the server can let the client know what key size(s) is/are acceptable to the server for the client's authentication.

Even with some (or proposed) ECC-based cipher suites, there is similar issue about key sizes for client’s authentication.


I would appreciate if you share what you think about the issues.

Regards,
Quynh.