Re: [TLS] New Version Notification for draft-bzwu-tls-ecdhe-keyshare-00.txt

[Ilari Liusvaara <[e-mail]>]

On Mon, Apr 27, 2015 at 08:28:16PM +0800, 武炳正(允中) wrote:
> 
> https://datatracker.ietf.org/doc/draft-bzwu-tls-ecdhe-keyshare/
> 
> This extension allows a TLS client to carry ECDHE keyshare in ClientHello message, so as to reduce the full handshake latency of 1RTT.
> 
> Please kindly review it. Any comments are welcomed.

Taking a quick look (not considering if this a good idea or not):

> In fact the new version, TLS verion 1.3
> [draft] which works in progress, supports only ECDHE for key
> exchange.

This is just wrong. In TLS 1.3 editor's copy and in latest draft,
non-ECC DHE is supported (2k, 3k, 4k and 8k).

(The value list seems to be out-of-sync with ffdhe draft, which
also has 6k).

> ECParameters    curve_params;

I consider supporting arbitrary curves here a bad idea. Why
not just use values out of EC Named Curve Registry (16-bit)?

(That's the way TLS 1.3 does it).

> So I have not find any security problem about this extension
> yet.

Another problem:

Defintion of extended_master_secret (security fix!) refers
to ClientKeyExchange. The relevant part would have to be
redefined (I guess taking session_hash after
ServerKeyExchange would work).

(Let's not get into working around THS by key checks).



-Ilari