Re: [TLS] FFDHE and SHOULDs on usage

[Thijs van Dijk <[e-mail]>]

On 18 April 2015 at 05:10, Martin Rex <[e-mail]> wrote:

> Could we just scrap the "based on xxx preference" nonsense entirely?
>
> The sender of the list sends whatever it sees fit, and the receiver
> of the list has the privilege to pick what ever the receiver believes
> is most appropriate from the receivers point of view.
>
> I never understood why (a) such a silly suggestion was made for
> the ordering of cipher suites in ClientHello and (b) why any TLS server
> implementaion would care for the client's ordering rather than enforcing
> the server preference.  If the client does not want something, it must
> not offer it.  If the server does not want something, it must not pick it.
>

I still think it's a reasonable safeguard against lazy server
implementations (e.g. mine): The naive way of implementing cipher agreement
is to loop through the client's suggestions and pick the first one both
client and server suport. If that happens to be an EXPORT/RC4 combo you're
out of luck.

However if either the client or the server exhibits a preference, you're
almost guaranteed to do better than both sides' worst case.

Furthermore, I think that conceptually, dropping client preference would
equate to making server preference a requirement. The TLS1.3 spec should
reflect this in some way, so it's not very language-economic either.

-Thijs