Re: [TLS] Confirming Consensus on removing RSA key Transport from TLS 1.3

[Daniel Kahn Gillmor <[e-mail]>]

On 03/26/2014 07:25 PM, Santosh Chokhani wrote:

> While I agree with most of what you say including some benefits of RSA, the DHE parameter verification by the client while desirable is not a genuine security threat.  A rogue server has many other ways to compromise the exchange,

The recent https://secure-resumption.com/ showed that one malicious
server (which a victim deliberately connects to) could use a weak
discrete log DHE group to force a client doing client-cert
authentication into signing a pre-master secret of the server operator's
choice.

The malicious server operator could then replay that pre-master secret
to another server (in a non-DHE ciphersuite), creating two sessions with
the same session id, master secret, and connection keys (they call this
an "Unknown key share attack" or UKS).

They didn't find a way to exploit a UKS directly without taking
advantage of other flaws in the TLS protocol, but if the option of using
a bad group hadn't been there, clients using DHE ciphersuites would have
been resistant to the attacks they did find.

So permitting the use of an arbitrary DL DH group whose structure is too
expensive for the client to verify is something we should try to avoid.

	--dkg