IETF Logo Mail Archive

[TLS] On axing DHE (was: Re: Confirming Consensus on removing RSA key Transport from TLS 1.3)

Rene Struik <rstruik.ext@gmail.com> Wed, 26 March 2014 19:08 UTC

Return-Path: <rstruik.ext@gmail.com>
X-Original-To: tls@ietfa.amsl.com
Delivered-To: tls@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 692891A0354 for <tls@ietfa.amsl.com>; Wed, 26 Mar 2014 12:08:43 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2
X-Spam-Level:
X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id aCHg6odGPfXA for <tls@ietfa.amsl.com>; Wed, 26 Mar 2014 12:08:41 -0700 (PDT)
Received: from mail-ee0-x233.google.com (mail-ee0-x233.google.com [IPv6:2a00:1450:4013:c00::233]) by ietfa.amsl.com (Postfix) with ESMTP id 730751A02D7 for <tls@ietf.org>; Wed, 26 Mar 2014 12:08:41 -0700 (PDT)
Received: by mail-ee0-f51.google.com with SMTP id c13so2038425eek.10 for <tls@ietf.org>; Wed, 26 Mar 2014 12:08:39 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=message-id:date:from:user-agent:mime-version:to:subject:references :in-reply-to:content-type:content-transfer-encoding; bh=nX4Wh/xIcSMk1X7cwgNYAF6CoZAP68Ko3+wxRuJXF9g=; b=WFLjawEXCnc1UEHwYthCvDI3cEfSsXsS22JY608Qe7COgJRgVGNArYHF0bi7HccP9X Y0D4ZtvlS77uaJQ9qEjunsntwwGSICJ7HjpAAsmcl/i1zPE+jCKga3e+f3P+cAlYbiEw XumibKj9nFNv7hRrJevpKccmG/mfVJVxhcGT7bwVhWaqVRSjgC3zhdT+Z5SPkDfh7d11 8yYW94vM7JIBFfG7gdXcVyYmHp7DAEwpH6QUZRTxnRorxBDKNFliajrTTadldnVz6PHI cYbYdbp9xJCQyWl2sYGMTg0b0B37UzSOGwdWPNhCDOi0LbDrFd0ZsjD2tJGAIEznLgkU SJhQ==
X-Received: by 10.15.111.206 with SMTP id cj54mr76332285eeb.8.1395860919537; Wed, 26 Mar 2014 12:08:39 -0700 (PDT)
Received: from [192.168.51.244] (217.64.249.186.mactelecom.net. [217.64.249.186]) by mx.google.com with ESMTPSA id 48sm48961036eee.2.2014.03.26.12.08.38 for <multiple recipients> (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Wed, 26 Mar 2014 12:08:38 -0700 (PDT)
Message-ID: <533325B5.7090705@gmail.com>
Date: Wed, 26 Mar 2014 15:08:37 -0400
From: Rene Struik <rstruik.ext@gmail.com>
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:24.0) Gecko/20100101 Thunderbird/24.4.0
MIME-Version: 1.0
To: "Joseph Salowey (jsalowey)" <jsalowey@cisco.com>, "<tls@ietf.org>" <tls@ietf.org>
References: <AD51D38F-2CFE-4277-854D-C0E56292A336@cisco.com>
In-Reply-To: <AD51D38F-2CFE-4277-854D-C0E56292A336@cisco.com>
Content-Type: text/plain; charset="ISO-8859-1"; format="flowed"
Content-Transfer-Encoding: 7bit
Archived-At: http://mailarchive.ietf.org/arch/msg/tls/dedRfoOf3MCrxdf7oHx-v2N5dkc
Subject: [TLS] On axing DHE (was: Re: Confirming Consensus on removing RSA key Transport from TLS 1.3)
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/tls/>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 26 Mar 2014 19:08:43 -0000

Hi Joe:

If one has concerns re "the general weakening of RSA over time", what 
about putting DHE (or, if one has more modest aspirations: DHE with MODp 
groups with short exponents) on the chopping block as well?

Best regards, Rene


On 3/26/2014 2:43 PM, Joseph Salowey (jsalowey) wrote:
> TLS has had cipher suites based on RSA key transport (aka "static RSA", TLS_RSA_WITH_*) since the days of SSL 2.0.   These cipher suites have several drawbacks including lack of PFS, pre-master secret contributed only by the client, and the general weakening of RSA over time.  It would make the security analysis simpler to remove this option from TLS 1.3.  RSA certificates would still be allowed, but the key establishment would be via DHE or ECDHE.  The consensus in the room at IETF-89 was to remove RSA key transport from TLS 1.3.  If you have concerns about this decision please respond on the TLS list by April 11, 2014.
>
> Thanks,
>
> Joe
> [Speaking for the TLS chairs]
> _______________________________________________
> TLS mailing list
> TLS@ietf.org
> https://www.ietf.org/mailman/listinfo/tls


-- 
email: rstruik.ext@gmail.com | Skype: rstruik
cell: +1 (647) 867-5658 | US: +1 (415) 690-7363

v2.23.0 | Report a Bug | By Email