Re: [TLS] New Version Notification for draft-bzwu-tls-ecdhe-keyshare-00.txt

[Ilari Liusvaara <[e-mail]>]

On Tue, Apr 28, 2015 at 02:41:18PM +0800, 武炳正(允中) wrote:
> 
> > 
> > Also, I consider using non-named groups to bring more security problems than
> > it is worth (e.g. currently known ways to exploit THS for (EC)DHE rely on those).
> 
> This extension aims to reduce the handshake's latency only.
> I think it's more clear that this extension behaves the same as normal handshake, both for SSL library's developer and web server administrator.
> If someone thinks non-named curve is not safe, he should find a way to disable it for normal handshake;
> and this extension will not use non-named curves then.
> 
> For example, a web server administrator may prefer the instructions that "non-named curve is not safe. disable it in configure file",
>  than " non-named curve is not safe. but there is an extension which disable it automatically. However you still need to disable it in configure file".

Actually, I think I figured out a nasty exploit.

By choosing a suitable curve (assuming both server and client accept
it), one can ECDL the server's exchange key and thus impersonate the
server. Extended_master_secret will not save you.

This exploit won't work with named groups (even without key order
check). This is because client's premaster secret is too hard to
compute.

Also, TLS 1.3 server auth is different, so the same exploit won't
work there either (even if it allowed non-named groups, which it
doesn't).


-Ilari