Re: [TLS] draft-sheffer-tls-bcp: DH recommendations

[Stephen Farrell <[e-mail]>]

Hi Yaron,

Thanks again for the draft. Without any hats, I think the
WG should adopt it too. (With a hat, if they don't, then I'd
AD sponsor it, and so I bet would Sean, but doing this makes
so much sense I bet the WG do adopt it:-)

I'd suggest merging 4.1 and 4.4, since setting out the set
of ciphersuites and the issues faced is really the meat of
the whole thing.

However, regardless of hows its organised, I'd have no
problem if the meat of the recommendation was
"use 1) TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 or
2) TLS_DHE_RSA_WITH_AES_128_GCM_SHA256" plus some guidance
as to good lengths for everything that can vary.

On the DHE length, I think a bit more information would be
useful if we can get it - exactly which clients or servers
have problems if DH values longer than 1024 are used? (Sorry
if I missed that earlier.)

But I'm firmly in the camp that thinks that 1024 DHE used
now is worthwhile and better than no PFS.

S.