Re: [TLS] AD review of draft-ietf-tls-negotiated-ff-dhe-08

[Stephen Farrell <[e-mail]>]

On 03/04/15 15:22, Sean Turner wrote:
> On Mar 31, 2015, at 19:56, Stephen Farrell
> <[e-mail]> wrote:
> 
>> #2 I've never quite gotten the reasoning behind not giving any
>> names to any of the RFC3526 curves and I think that question
>> deserves an answer (to be in the list archive). So - why not?
> 
> Maybe I’m not following but are you asking that we retroactively name
> the "4096-bit MODP Group”?

Right, that and any others we still like. The thought is that
we might get a minor security benefit if the client says that
they're ok with e.g. the 2048-bit MODP group thereby causing
some server to not try use a custom group or the old smaller
groups. (I mean that'd be a minor benefit compared to the
current situation, not compared to what the draft proposes.)

It's not a major thing as the client can still just check for
the RFC3626 groups but I'm not sure how likely it is that'd
be done. OTOH, anyone who updates their code to handle this
can just as easily adopt the new groups, and I don't think
there's any particular benefit to sticking with the RFC3526
groups (e.g. there's no dedicated h/w for those I think).

So if the answer is "yeah, we considered that and didn't like
it because <foo>" that's fine, I just don't recall having seen
it on the list.

It's also fine if the answer is "we didn't think of that, but
we still don't like it" btw:-)

S.


> 
> spt
>