Re: [TLS] AD review of draft-ietf-tls-negotiated-ff-dhe-08

[Geoffrey Keating <[e-mail]>]

[e-mail] (Martin Rex) writes:
> >Martin Rex wrote:
> >> RFC4492 contains the following explicit prohibition (Section 4, 4th paragr.):
> >> 
> >>    https://tools.ietf.org/html/rfc4492#section-4
> >> 
> >> 
> >>    The client MUST NOT include these extensions in the ClientHello
> >>    message if it does not propose any ECC cipher suites. 

> The result is, that there may easily exist server implementation of rfc4492
> which abort the TLS handshake when they receive a TLS ClientHello with
> the TLS ECC named_curve extension (and only ffdhe named curves in it)
> but no accompanying ECC cipher suites in the ClientHello cipher_suites_list,
> and that interoperability failure OUGHT to be avoided.  REALLY.

There's no way an implementation can be sure there are no ECC cipher
suites proposed unless it recognizes every proposed cipher suite, and
I understand that elsewhere we're proposing a complete redesign of the
cipher suites so there will always be cipher suites that a pre-1.3
implementation does not recognize.

Implementations could be buggy, of course---but that's always true.