[TLS] changes to draft-ietf-tls-negotiated-ff-dhe-09

[Daniel Kahn Gillmor <[e-mail]>]

Hi TLS folks--

As a result of ongoing feedback, i've made several more minor changes to
draft-ietf-tls-negotiated-ff-dhe, which are now visible in version 09 of
that document.

There were several minor nits addressed, but the following minor changes
are slightly more than nits:

 * the draft clarifies that the named ffdhe* groups do have a small
   subgroup, but that it is easily avoided (as opposed to custom groups,
   in which possible small subgroups are either unknown or expensive to
   avoid).  

 * slight tuning of some of the RFC 2119 language.

 * explicitly relaxing the old requirement that the Supported Groups
   extension needed to be sent only when ECDHE ciphersuites were
   offered, which no one appears to have followed anyway

 * Added a new section describing local policy for compatible clients
   that are considering accepting custom groups from the server, with
   baseline guidance for how to protect users by at least ensuring that
   the length of the group is minimally strong (no attempt is made to
   enumerate all possible local policy or to claim there is only one
   legitimate local policy).

 * encourage bounds checking of the public share against the group
   modulus, regardless of whether a named group is used.

Thanks to all the folks who gave feedback on the draft.

Regards,

        --dkg