Re: [TLS] I-D Action: draft-ietf-tls-negotiated-ff-dhe-10.txt

Tony Arcieri <> Wed, 03 June 2015 20:51 UTC

Return-Path: <>
Received: from localhost ( []) by (Postfix) with ESMTP id 857D41B2B48 for <>; Wed, 3 Jun 2015 13:51:01 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: 0.5
X-Spam-Status: No, score=0.5 tagged_above=-999 required=5 tests=[BAYES_20=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, J_CHICKENPOX_12=0.6, SPF_PASS=-0.001] autolearn=no
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id G-0iFqz8bPZI for <>; Wed, 3 Jun 2015 13:51:00 -0700 (PDT)
Received: from ( [IPv6:2607:f8b0:4003:c01::234]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by (Postfix) with ESMTPS id 1101F1B2B45 for <>; Wed, 3 Jun 2015 13:51:00 -0700 (PDT)
Received: by objn8 with SMTP id n8so17944728obj.3 for <>; Wed, 03 Jun 2015 13:50:59 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; bh=VG0FfVU6sA6dOL4DdFKKtNJr5Au3tzODNF7R/O1xzd0=; b=ww4Q4XpjC2LnOqJUDhu2nbtf+I7la6V7br/o0GYe8CK5a9MgAz5u3YH5kKjcB/D7vt yRGkCDA12ozbW09dEJQUPt7vHoEUf1jKN01G0OPWCgeOonrL25oW7XHK+xcAwSf45Sju lmYLC4Fwbpq12HtLgice74UpqfL5SF4mb2l4aj9RmIRVhHNdpr6/gy2Hu7YHwjVPZ93m AJQveKZ6JX0Ps3FvZ8+AfmfxJToAOqJ7Uv/FLnvR7UMz5NEHVjnv+lE4enoxJN7h0GTe 6Xv3IIukZPQLoAXxbItAHZKtOnXR6yCBY+oYWlMOuQj5z+KaXdSPPx5jnJMlIKBs5jf5 GzvA==
MIME-Version: 1.0
X-Received: by with SMTP id l1mr21511373oex.60.1433364659503; Wed, 03 Jun 2015 13:50:59 -0700 (PDT)
Received: by with HTTP; Wed, 3 Jun 2015 13:50:59 -0700 (PDT)
In-Reply-To: <>
References: <> <> <> <>
Date: Wed, 3 Jun 2015 13:50:59 -0700
Message-ID: <>
From: Tony Arcieri <>
To: Dave Garrett <>
Content-Type: multipart/alternative; boundary=089e011773735d0bcf0517a3379c
Archived-At: <>
Cc: "<>" <>, Geoffrey Keating <>
Subject: Re: [TLS] I-D Action: draft-ietf-tls-negotiated-ff-dhe-10.txt
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Wed, 03 Jun 2015 20:51:01 -0000

On Wednesday, June 3, 2015, Dave Garrett <> wrote:

> The topic brought up by Tony Arcieri was the apparent plague of old Java
> clients using TLS currently. A replacement set of cipher suites would
> transparently fix this in a simpler way. It adds more suites, yes, but it
> would ensure that this is only ever even _attempted_ to be negotiated
> between clients and servers that both support them properly.

That's "half the battle", IMO, and I think the other half of my argument
was lost in a swarm of "LOL Java, there's your problem" responses. I also
called out the "what about a catastrophic ECC failure?" in advance and yet
that is somehow the main "pedantic" response I've been receiving to my

I get it. I get it so much I predicted people would say it in my very first
post to this thread. Then they confirmed my hypothesis. But if we're
switching to ECC for certificates too, what hypothetical attack breaks ECDH
but not ECDSA/EdDSA/etc, and is it really worth convoluting TLS with extra
baggage in preparation of a hypothetical attack? Should everyone continue
to obtain RSA certs i. the event of an ECCpocalypse?  I'm pretty firmly
convinced people aren't really fully thinking through. The pat-on-the-head
"you don't understand we need this if ECC breaks" responses are myopic,
insulting, and an indicator that people aren't actually
reading/comprehending my arguments here (the same goes for "that's just a
Java problem" reaponses)

The main thing I'ge observed as an SSL/TLS practicioner is extra bells and
whistles that aren't commonly used leading to practial attacks, and people
making haphazard changes to defend against these attacks breaking clients
in the process. I care a lot more about the attacks and breakages happening
in the real world *right now* than extremely speculative future attacks for
which we're pre-emptively adding additional baggage/attack surface.

That said, I think everyone is convincing me FFDHE *might* be a good idea.
Particularly persuasive is Ilari's argument that with some tiny changes,
ECDHE and FFDHE can be unified.

Tony Arcieri