Re: [TLS] Confirming Consensus on removing RSA key Transport from TLS 1.3

[Viktor Dukhovni <[e-mail]>]

On Tue, May 06, 2014 at 11:13:18AM +0200, Nikos Mavrogiannopoulos wrote:

> On Mon, 2014-05-05 at 10:23 -0700, Eric Rescorla wrote:
> > You're probably thinking of:
> > http://tools.ietf.org/html/draft-gillmor-tls-negotiated-dl-dhe-02
> 
> > This seems like a reasonable kind of thing for the WG to
> > consider,
> 
> I believe that this draft addresses the existing concerns with the DH
> ciphersuites I'm aware of, and would be very good if the TLS WG would
> adopt it.

Other collections of DHE groups work in a subgroup of order "q",
where log(q) ~ 2^{security factor}.  This speeds up the arithmetic.
(Squares can be reduced modulo the much smaller q).  Is there a
reason to avoid those?  Problems with constant-time implementation?
Other concerns?

-- 
	Viktor.