Re: [TLS] WGLC: draft-ietf-tls-negotiated-ff-dhe-05

[Daniel Kahn Gillmor <[e-mail]>]

On Wed 2015-02-18 13:12:33 +0100, Sean Turner wrote:
> The WGLC has concluded.  dkg noted he’d received some comments
> off-list and Watson provide some input.  We’ll need a new version to
> review the changes to see if it should be progressed or whether
> another WGLC is needed.  I’ve updated the datatracker to reflect the
> new state.
>
> dkg,
>
> Any chance of another version before the 2015-03-09 draft submission deadline?

I've just submitted -06.  The changes from -05 are:

 * re-added 6144, at the request of Niels Ferguson, who wanted a
   smoother ramp-up for people who want to increase adversarial work
   factor.

 * made the recommended minimum exponent size more conservative,
   referencing NIST strength estimates.

 * added a "private use" sub-range within the ffdhe range for
   organizations that want to use their own pre-selected groups.

 * adjusted the false-start guidance slightly.  I agree with Brian Smith
   that this guidance really does belong in the false-start draft
   itself, but given that it is not there yet, i've left it here.  I
   don't think there will be a problem if the false-start draft simply
   repeats the same guidance.

I did not change the "special form" of the groups.

In particular, i left the leading and trailing bits set to 1 for more
efficient reduction, since that is used in practice.  There appear to be
no published attacks against this form (and it is widely used elsewhere,
so it should be an attractive target for research), and the concerns i
heard were that maybe the group strength could be weakened by the number
of bits held constant this way (128 bits, in this case).  For people who
have this concern, i recommend that they select a slightly larger group,
which should more than offset this difference.

   --dkg