Re: [TLS] Obstacles to standardizing ECC in TLS

[Peter Gutmann <[e-mail]>]

Eric Rescorla <[e-mail]> writes:

>As you no doubt know, TLS already specifies a number of ECC-based cipher
>suites (RFC 4492 and following) and there are interoperable implementations
>of many of these cipher suites. The two relevant questions for the TLS WG
>seem to me to be:
>
>[...]

There are actually more issues than that with ECC, see
http://tools.ietf.org/html/draft-gutmann-tls-eccsuites-05 for details:

   [3] provides an extremely flexible, and by extension extremely
   complex means of specifying a large number of options involving the
   use of ECC algorithms for [2].  As such the "cipher suites" in [3]
   aren't suites in the conventional TLS sense but more an indication of
   intent to negotiate a Chinese menu, with details to be decided on
   later via various TLS extensions and parameter settings.  This makes
   deciding on a particular suite nondeterministic, since later
   parameter choices and settings can negate the initial "cipher suite"
   choice, requiring returning to the suite list to try with another
   Chinese-menu suite in the hope that later parameter choices allow it
   to be used.

   In practice no currently deployed implementation actually does this,
   either dropping the connection or aborting the handshake with a
   handshake-failure if the expected parameters aren't present
   throughout the various locations in the TLS handshake in which ECC
   parameters can be specified.  This means that establishing a TLS
   connection using ECC often requires trial-and-error probing to
   ascertain what the other side is expecting to see before a connection
   can be established.

   Experience with deployed implementations indicates that all of them
   appear to implement a common subset of fixed ECC parameters that work
   in all cases (alongside the more obscure options), representing a de
   facto profile of standard cipher suites rather than Chinese-menu
   selection options.  For example one widely-used implementation didn't
   send out TLS ECC extensions and yet other implementations had no
   problems interoperating with it, indicating that what this document
   specifies is already a de facto profile of implementations.  This
   document standardises this de facto usage by defining a small number
   of standard ECC cipher suites with unambiguous parameters and
   settings.

Peter.