IETF Logo Mail Archive

Re: [TLS] I-D Action: draft-ietf-tls-negotiated-ff-dhe-10.txt

Tony Arcieri <bascule@gmail.com> Wed, 03 June 2015 08:49 UTC

Return-Path: <bascule@gmail.com>
X-Original-To: tls@ietfa.amsl.com
Delivered-To: tls@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E433C1B366F for <tls@ietfa.amsl.com>; Wed, 3 Jun 2015 01:49:18 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.999
X-Spam-Level:
X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id lDqNYFmQ_VvY for <tls@ietfa.amsl.com>; Wed, 3 Jun 2015 01:49:17 -0700 (PDT)
Received: from mail-ob0-x22e.google.com (mail-ob0-x22e.google.com [IPv6:2607:f8b0:4003:c01::22e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0E3851B366E for <tls@ietf.org>; Wed, 3 Jun 2015 01:49:16 -0700 (PDT)
Received: by objn8 with SMTP id n8so2440041obj.3 for <tls@ietf.org>; Wed, 03 Jun 2015 01:49:16 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc:content-type; bh=/GsP17QBnpODNli5KU9o/f4v2o7JNJjSs28ztdPkyN4=; b=ftLtAeZyq0YEOCXASAkohJwFpbNatk5IHIJLU324FrDFNsHcO2GvVG+lX7KtHrsNpN h9oIjCC7PxYegaN2Pxod/U0Zu+waClwK7lcZE/kSSGyWoQ/HePE9AbciGKbRHQbk2lyl gU/w7xYvIbjLy2pWL0ILAJswfx6geEzMuz/8Vx1w9vkZu2juULZEJdsWCx/33GgCdbz5 e+zOgTIdgeY5sQvXOac/2jTjqGmRe5xsV8v1EyA/P2Xio7JALpQGknZwxM7b+0VXWBEz RitqgYinqxUceZcN/pdvGL1CFxLm1pAroC8l5ND/Jxi98AqBvXCJrz/bGRkUeRuic6M4 Ysiw==
X-Received: by 10.202.174.67 with SMTP id x64mr24877828oie.50.1433321356550; Wed, 03 Jun 2015 01:49:16 -0700 (PDT)
MIME-Version: 1.0
Received: by 10.76.110.241 with HTTP; Wed, 3 Jun 2015 01:48:56 -0700 (PDT)
In-Reply-To: <9A043F3CF02CD34C8E74AC1594475C73AB034FEB@uxcn10-tdc05.UoA.auckland.ac.nz>
References: <20150601225057.17500.96911.idtracker@ietfa.amsl.com> <CAHOTMVJ1xu+mEaROWKuEtW1E8Ks3r3gKagEM9mJdBOKW3kSZJQ@mail.gmail.com> <1474500.r0W7gM0pAO@pintsize.usersys.redhat.com> <CAHOTMVJgqqRBYWR+8LtwxfdRVWxEXLZAgzr5Q-1DH7ejONAGnw@mail.gmail.com> <m2lhg1b8us.fsf@localhost.localdomain> <CAHOTMVLrgUNi449DQwggt556ioEeXCQTUN+M3phBftPk88xtOw@mail.gmail.com> <BLU177-W17E87DB68F54CE64BDC44C3B40@phx.gbl> <CAHOTMVLpmS94cBZOxu6e3-e2MMO+Z0SAvPb7dWW47jQqXpT9+A@mail.gmail.com> <BLU177-W1EA1B34A70F648FD8C139C3B40@phx.gbl> <CAHOTMV+FxxG7tpq55UyKs+q06uk5H-dCqkTswBDJsM=5Bv6pqA@mail.gmail.com> <9A043F3CF02CD34C8E74AC1594475C73AB034F5F@uxcn10-tdc05.UoA.auckland.ac.nz> <CAHOTMVJM7tw8gDzaAOxoi39aC3v_PycFay3Jg6e09Wx5k9H4cw@mail.gmail.com> <9A043F3CF02CD34C8E74AC1594475C73AB034FEB@uxcn10-tdc05.UoA.auckland.ac.nz>
From: Tony Arcieri <bascule@gmail.com>
Date: Wed, 03 Jun 2015 01:48:56 -0700
Message-ID: <CAHOTMVLTt8d8AORa3ymOby9FhJqHb7Qq28tJT6+QdoM+4WBhdA@mail.gmail.com>
To: Peter Gutmann <pgut001@cs.auckland.ac.nz>
Content-Type: multipart/alternative; boundary="001a113cefa44e695f05179922c9"
Archived-At: <http://mailarchive.ietf.org/arch/msg/tls/b5molN9b-9Gcm0e6CR__G-Cj87g>
Cc: Geoffrey Keating <geoffk@geoffk.org>, TLS WG <tls@ietf.org>
Subject: Re: [TLS] I-D Action: draft-ietf-tls-negotiated-ff-dhe-10.txt
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/tls/>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 03 Jun 2015 08:49:19 -0000

On Wed, Jun 3, 2015 at 1:43 AM, Peter Gutmann <pgut001@cs.auckland.ac.nz>
wrote:

>  You seem to want everyone to change their behaviour in order to
> accommodate
> the fact that you've chosen to use a broken, buggy implementation
>

These aren't clients under my control. I am talking about an entire
language ecosystem here, not just my little corner of the world. But even
if they were my clients, they wouldn't negotiate DHE anyway, because most
configurations would prefer ECDHE.

The "accommodation" you're defending is using finite-field Diffie-Hellman.
Most clients support ECDH(E) and don't need to support finite-field
Diffie-Hellman.

Finite field Diffie-Hellman is a slow, outmoded legacy key exchange
algorithm that in my opinion should completely be abandoned.

I didn't even bring up Java, but it was cited as a reason for FFDHE to
exist. However Java 7 and 8 clients would prefer ECDHE anyway. As they
should, it's faster and uses smaller keys.

This is a case of some legacy gunk left over from the early days of TLS
breaking key exchange for clients that support better algorithms.

We can either double down on the gunk, or shut it off.

*In practice* I have been telling people to shut it off and so far it's
been a successful solution to the problem.

Why should we keep this legacy gunk around? Who is it helping?

-- 
Tony Arcieri

v2.23.0 | Report a Bug | By Email