Re: [TLS] I-D Action: draft-ietf-tls-negotiated-ff-dhe-10.txt

[Tony Arcieri <[e-mail]>]

On Wednesday, June 3, 2015, Dave Garrett <[e-mail]> wrote:

> The topic brought up by Tony Arcieri was the apparent plague of old Java
> clients using TLS currently. A replacement set of cipher suites would
> transparently fix this in a simpler way. It adds more suites, yes, but it
> would ensure that this is only ever even _attempted_ to be negotiated
> between clients and servers that both support them properly.


That's "half the battle", IMO, and I think the other half of my argument
was lost in a swarm of "LOL Java, there's your problem" responses. I also
called out the "what about a catastrophic ECC failure?" in advance and yet
that is somehow the main "pedantic" response I've been receiving to my
complaints.

I get it. I get it so much I predicted people would say it in my very first
post to this thread. Then they confirmed my hypothesis. But if we're
switching to ECC for certificates too, what hypothetical attack breaks ECDH
but not ECDSA/EdDSA/etc, and is it really worth convoluting TLS with extra
baggage in preparation of a hypothetical attack? Should everyone continue
to obtain RSA certs i. the event of an ECCpocalypse?  I'm pretty firmly
convinced people aren't really fully thinking through. The pat-on-the-head
"you don't understand we need this if ECC breaks" responses are myopic,
insulting, and an indicator that people aren't actually
reading/comprehending my arguments here (the same goes for "that's just a
Java problem" reaponses)

The main thing I'ge observed as an SSL/TLS practicioner is extra bells and
whistles that aren't commonly used leading to practial attacks, and people
making haphazard changes to defend against these attacks breaking clients
in the process. I care a lot more about the attacks and breakages happening
in the real world *right now* than extremely speculative future attacks for
which we're pre-emptively adding additional baggage/attack surface.

That said, I think everyone is convincing me FFDHE *might* be a good idea.
Particularly persuasive is Ilari's argument that with some tiny changes,
ECDHE and FFDHE can be unified.


-- 
Tony Arcieri