Re: [TLS] Still missing: TLS_ECDH_anon_WITH_AES_xxx_GCM_SHAxxx

[Daniel Kahn Gillmor <[e-mail]>]

On 03/12/2014 05:12 AM, Manuel Pégourié-Gonnard wrote:

> Sorry if I'm missing something obvious, but why would ECDH_anon be a requirement
> for opportunistic TLS? Can't we just use certificates and not validate them?

using certificates and expecting the peer to not validate them has a
couple downsides:

 0) either the software or the admin must manually provision the
certificate for the server; this means making decisions about questions
that don't necessarily have any good answers, which is not a situation
you want your users to be in.  Servers operating in a pool now need to
have some sort of secret key distribution mechanism, for example.

 1) as peers start using TOFU-like mechanisms (which cannot be
controlled or even necessarily observed by the server itself, the
choices made in (0) become relevant -- want to rotate your key?  want to
deploy a "real" certificate?  want to deploy a certificate issued by
your private CA? all of a sudden your server's identity has changed from
one explicit identity to another.

In the anon case, you can have simple, automatic, configuration-less
deployment that makes no claims of identity at all.

> Or are you rather interested in the performance gain of ECDH_anon over
> authenticated and forward-secure key exchanges?

the performance difference on the server side is one RSA or ECDSA
signature per connection; i don't think this is likely to be a large
factor, though i guess it depends on the key size.

	--dkg