Re: [TLS] I-D Action: draft-ietf-tls-negotiated-ff-dhe-02.txt

[Watson Ladd <[e-mail]>]

On Sat, Oct 25, 2014 at 1:16 PM, Ilari Liusvaara
<[e-mail]> wrote:
> On Sat, Oct 25, 2014 at 12:55:58PM -0700, Watson Ladd wrote:
>> On Sat, Oct 25, 2014 at 12:51 PM, Nikos Mavrogiannopoulos
>> <[e-mail]> wrote:
>>
>> > 3. There are known attacks against the current ServerKeyExchange format which
>> > remain applicable if we go this path (a sufficiently long DH serverkeyexchange
>> > message can be parsed as an ECDH serverkeyexchage).
>>
>> And 4: session_hash solves the same problem if I understand the
>> elements of it correctly, and we need it anyway because of this
>> ambiguity in parsing mentioned above. So do we even need this draft?
>
> AFAIK, no, it won't, at least not completely.

I'm afraid I didn't realize how what I wrote would be read. It seems
to me that the session_hash doesn't necessarily fix the ambiguity
issue, but does ensure that sending bad groups will achieve nothing
for an attacker. Even if we adopt this draft for DHE, session_hash is
still needed in TLS 1.2. So what does this draft get us, assuming
session_hash is deployed?

>
> (TLS 1.3 has this problem fixed, even without session_hash[1]).
>
>
> [1] Without session_hash TLS 1.3 is broken in other ways without DH
> order check (and one can't rely on endpoints to perform such check
> even if it is feasible, so session_hash is a good idea there too).
>
>
> -Ilari



-- 
"Those who would give up Essential Liberty to purchase a little
Temporary Safety deserve neither  Liberty nor Safety."
-- Benjamin Franklin