Re: [TLS] draft-sheffer-tls-bcp: DH recommendations

[Yaron Sheffer <[e-mail]>]

Hi Martin,

IMHO this is far from clear-cut.

There is some IPR mess surrounding ECC. But I know of vendors who are 
avoiding it by interpreting the IPR statement as referring to CAs 
(rather than endpoints), with the NSA license and RFC 6090 serving as 
fallback (NSA is your friend :-). As an example, Red Hat and Canonical 
are arguably in a similar position, but Canonical includes OpenSSL with 
ECC while RH disables it.

Our -00 draft proposed MODP DH, because it is simpler and more widely 
implemented. But I now prefer ECDH despite the drawbacks of ECC, because:

- Important implementations are broken, and will abort the connection 
when receiving >1024-bits DH.
- Modular DH cannot be negotiated, so there's no way for the server to 
know what the client supports and whether it'll break.

Thanks,
	Yaron

On 09/17/2013 04:14 PM, Martin Rex wrote:
> Yaron Sheffer wrote:
>> So yes, I agree. Here's from our work-in-progress -01 version:
>>
>> As currently specified and implemented, elliptic curve groups are
>> preferable over modular DH groups: they are easier and safer to use
>> within TLS.
>
> Elliptic curve crypto is still fenced with non-expired patent claims,
> requires an implementation of elliptic curve algorithms and the
> relevant TLS extensions (something which is FAR from universally
> available) and elliptic curve technology is considerably more
> sensitive to side channel (=timing) attacks that DH, RSA & DSA.
>
> -Martin
>