Re: [TLS] Working Group Last Call for draft-ietf-tls-pwd

[Bodo Moeller <[e-mail]>]

Dan Harkins:


>   That said, the issue you bring up remains since it is also possible to
> just send the complete domain parameter set. But this is how TLS handles
> discrete logarithm-style cryptographic parameter negotiation. So this
> issue applies to every TLS cipher suite that provides for some kind of
> exchange using discrete logarithm cryptography, including all of the
> ones with DH in the key exchange-- i.e. DHE, ECDH, ECDHE, etc. This
> "full flexibility" issue sounds more like something for TLSv1.3  than for
> TLS-pwd.
>

While parameter negotiation does look like that for TLS DHE ciphersuites,
that's actually a very different issue, because there these groups are used
differently: either parameters are authenticated (signed by the server's
public key from the server cert) or the server is entirely anonymous.  This
is very different from relying on initially unauthenticated parameters for
a password-authenticated key exchange, where the security issues that I
described come up.

Bodo