Re: [TLS] I-D Action: draft-ietf-tls-negotiated-ff-dhe-02.txt

[Ilari Liusvaara <[e-mail]>]

On Sat, Oct 25, 2014 at 06:45:51PM +0200, Henrick Hellström wrote:
> On 2014-10-11 06:55, Daniel Kahn Gillmor wrote:
> >I'd appreciate any comments or suggestions, and particularly review
> >related to the IANA considerations would be great.
> 
> It seems to me the the recommended Client Behavior and Server Behavior has
> to be simplified and strengthened, in order for the standard to meet the
> security objectives.
> 
> All relevant attacks here https://secure-resumption.com/ seem to involve a
> MITM server that chooses bad ServerDHParams for the server key exchange
> message.

I see two problematic cases:
1) NG SKE gets presented as EC(!) SKE.
2) NG SKE gets presented to non-NG client.


1) The message is:

00 02 01 xx 00 01 00 <length of ge> <ge>

When interpretted as elliptic curve, this has curve type of 0, which is
not valid, so handshake can't work.


2) Here it might be a better idea to have group id in generator and have
modulus of 0, instead of generator 0 and modulus being group id.

This is to make buggy software more likely to blow up.

(after swapping the fields, the EC curve type is still 0).

16-bit prime does not make certain infamous TLS library reject the
handshake!



-Ilari