Re: [TLS] New Algorithm identifier for EDH > 1024 bits?

[Yaron Sheffer <[e-mail]>]

Yes, the problem is with clients not accepting the server's parameter 
choice.

I would prefer an extension to solve this problem, because:
- You can encode more information, e.g. the minimum AND maximum 
parameter sizes acceptable to the client.
- It is similar to RFC 4492.
- You avoid the cross-product problem of specifying large DHE versions 
for lots of cipher suites.

Thanks,
	Yaron

On 09/26/2013 05:51 PM, Wan-Teh Chang wrote:
> On Thu, Sep 26, 2013 at 7:15 AM, Phillip Hallam-Baker <[e-mail]> wrote:
>> My understanding of the 1024 bit Ephemeral DH key issue is that it is not
>> currently possible to use longer keys because a certain number of deployed
>> Web servers will abort the connection if a client presents a longer key.
>
> The size of ephemeral DH keys is specified by the server, and the
> client must present a key of that size. (This doesn't change the
> problem though.)
>
> The client needs a way to negotiate the ephemeral DH key size (or the
> DH domain parameters) with the server. This can be done by either an
> extension (similar to the elliptic_curves extension of RFC 4492 for
> ephemeral ECDH keys) or new cipher suites.
>
> Wan-Teh Chang
>
>
>>