Re: [TLS] Still missing: TLS_ECDH_anon_WITH_AES_xxx_GCM_SHAxxx

[Nico Williams <[e-mail]>]

On Wed, Mar 12, 2014 at 4:12 AM, Manuel Pégourié-Gonnard
<[e-mail]> wrote:
> On 03/11/2014 11:49 PM, Nico Williams wrote:
>> This is a big problem for anything that wants to do opportunistic TLS
>> (e.g., MTAs, like Postfix).
>>
> Sorry if I'm missing something obvious, but why would ECDH_anon be a requirement
> for opportunistic TLS? Can't we just use certificates and not validate them?
>
> Or are you rather interested in the performance gain of ECDH_anon over
> authenticated and forward-secure key exchanges?

Just because a client and server negotiated an anon ciphersuite does
NOT mean that they won't authenticate each other.

For example:

 - the client might initiate renegotiation to send an SNI and get an
appropriate server certificate,

 - or the client might use application-layer authentication with
channel binding.

Or maybe not authenticating each other is fine and then -yes- ECDH
performance will be appealing.

In the SMTP case when there's no TLSA RRs in the DNS for the server
and the server has no certificates, the client may prefer to use anon
DH/ECDH.  Considering that e-mail has historically had very poor
privacy protection, that would be a huge step up.  But today an SMTP
client can't get high-performance ECDH and AEAD ciphers :(

Nico
--