Re: [TLS] I-D ACTION:draft-ietf-tls-psk-null-00.txt

On Thu, Jul 20, 2006 at 06:50:01PM -0400, Internet-Drafts@ietf.org wrote:

> 	Title		: Pre-Shared Key Cipher Suite with NULL Encryption for Transport Layer Security 
> 	Author(s)	: U. Blumenthal, P. Goel
> 	Filename	: draft-ietf-tls-psk-null-00.txt
> 	Pages		: 5
> 	Date		: 2006-7-20
> 	
>    This document specifies authentication-only cipher suites for the 
>    Pre-Shared Key based [TLS-PSK] Transport Layer Security (TLS) [TLS] 
>    protocol to support null encryption. These cipher suites are useful 
>    for countries and places with cryptography-related restrictions.  

> http://www.ietf.org/internet-drafts/draft-ietf-tls-psk-null-00.txt

The new I-D contains three ciphersuites:

    TLS_PSK_WITH_NULL_SHA
    TLS_DHE_PSK_WITH_NULL_SHA
    TLS_RSA_PSK_WITH_NULL_SHA

Is there a good case for definining a DHE_PSK ciphersuite with NULL
encryption?  RSA_PSK involves server certificates, so it does not
solely rely on pre-shared keys for authentication.  DHE_PSK, however,
uses ephemeral Diffie-Hellman without certificate-based
authentication.  This is very useful when the key exchange is used to
obtain keys for symmetric encryption.  However, in these NULL
encryption ciphersuites, the key exchange is only used to derive
authentication keys, so there is only a very limited need for forward
security.  (DHE_DSK, when using NULL encryption, provides protection
against exposure of a pre-shared key if use of said key has been
stopped, but TLS session based on the key remain active.)

If we are going to allocate additional ciphersuite numbers for new PSK
ciphersuites, other key exchange mechanisms for use with symmetric
encryption would appear more useful to me than DHE_PSK for NULL
encryption: RFC 4247 does not have any DHE_RSA_PSK and EDH_DSS_PSK
methods, which would combine ephemeral Diffie-Hellman with RSA or DSA
certificates -- thus providing both forward security and
certificate-based server authentication.  I don't know if this variant
is really needed (probably so rarely that combining multiple different
key exchange methods via renegotiation is a more reasonable technique
than specifying another set of specific ciphersuites), but it
certainly looks more useful to me than TLS_DHE_PSK_WITH_NULL_SHA!

So currently I think we should cut down the I-D to only two
ciphersuites, TLS_PSK_WITH_NULL_SHA and TLS_RSA_PSK_WITH_NULL_SHA.

_______________________________________________
TLS mailing list
TLS@lists.ietf.org
https://www1.ietf.org/mailman/listinfo/tls