Re: [TLS] DSS with other than SHA-1 algorithms

[Peter Gutmann <[e-mail]>]

=?iso-8859-1?Q?Juho_V=E4h=E4-Herttua?= <[e-mail]> writes:

>I'm sorry I probably wasn't clear enough in my message. I was trying to ask,
>when exactly will the client say that it wants to do P256? Are we talking
>about an exchange where the client doesn't send the elliptic_curves extension
>in its hello message?

Yes.  It transforms the current ECC "suites", which aren't really suites at
all but more an indication of intent to navigate a Chinese menu with details
to be decided later, into true cipher suites.

>1. Client sends a ClientHello with elliptic_curves extension specifying its
>supported extensions

But the elliptic_curves extension isn't part of the ClientHello.  This is the
problem, the ClientHello contains a notification-of-intent and then later bits
and pieces contain the actual suite details.  If any of the later bits and
pieces don't as expected you have to go back to the ClientHello and try
another Chinese-menu option, then go back to the later extensions and see
if... and so on, although in practice everything I've seen so far just aborts
the handshake if they don't see exactly what they expect.

>But I'm using TLS on some devices that simply don't have the processing
>capacity to do P-256 handshakes well.

That's no problem, nothing in the ECC-suites proposal says you can't still use
ECC-Chinese-menu to negotiate whatever you want.  All ECC-suites does is
provide a few standardised true suites that everyone can agree on.

>Sorry if I'm going too much into details here, but I'm simply trying to say
>that requiring support for P-256 might leave out a large number of devices
>with lower capabilities.

Oh no, this doesn't mandate anything, it just provides a single, standard,
unambiguous way of indicating a few common ECC choices, leaving the full
Chinese-menu capability in place for people whose needs aren't met by the
fixed suites.

Peter.