Re: [TLS] Re: TLS 1.2 draft

On Wed, 07 Mar 2007 10:53:00 +0100
Simon Josefsson <simon@josefsson.org> wrote:

> Eric Rescorla <ekr@networkresonance.com> writes:
> 
> > What I'm saying is that the recommendation to prevent his attack
> > is to use an RSA_DHE ciphersuite
> 
> I agree with that.  However, if I remember correctly, DHE key
> exchanges are generally slower than plain RSA key exchanges with
> temporary keys, although it depends on the DH group size.

The problem is generating the two large primes for the RSA key pair.

> 
> > and use a fresh DH ephemeral with each key exchange. This provides
> > the same security at a substantially superior performance level.
> 
> Generating a fresh DH ephemeral with each key exchange would deplete
> the entropy in many RNG's.
> 
> Perhaps we could discuss the frequency that DH ephemeral's should be
> changed, possibly also in the document.

I think the strategy used in JFK
(http://www.cs.columbia.edu/~smb/papers/jfk-ccs.pdf) would help.

> _______________________________________________
> TLS mailing list
> TLS@lists.ietf.org
> https://www1.ietf.org/mailman/listinfo/tls
> 

		--Steve Bellovin, http://www.cs.columbia.edu/~smb

_______________________________________________
TLS mailing list
TLS@lists.ietf.org
https://www1.ietf.org/mailman/listinfo/tls