Re: [TLS] I-D Action: draft-ietf-tls-negotiated-ff-dhe-02.txt

[Ilari Liusvaara <[e-mail]>]

On Sat, Oct 25, 2014 at 08:06:02PM +0200, Henrick Hellström wrote:
> On 2014-10-25 19:25, Ilari Liusvaara wrote:
> >I see two problematic cases:
> >1) NG SKE gets presented as EC(!) SKE.
> >2) NG SKE gets presented to non-NG client.
> >
> >
> >1) The message is:
> >
> >00 02 01 xx 00 01 00 <length of ge> <ge>
> >
> >When interpretted as elliptic curve, this has curve type of 0, which is
> >not valid, so handshake can't work.
> 
> I think this should be of no consequence. A client that interprets a DHE SKE
> as an ECDHE SKE, despite having negotiated a DHE cipher suite, is broken
> beyond repair and would be pointless to try to be compatible with.

Unfortunately, attacker can make client interpret DHE SKE as ECDHE SKE
(or vice versa). TLS key exchange is just screwed up.

Oh, I also missed interpretting ECDHE SKE as posibly-NG DHE. This always
results in prime of length 256 or above. So if prime length is restricted for
NG DHE, these can't be confused with NG DHE.


-Ilari