Re: [TLS] I-D Action: draft-ietf-tls-negotiated-ff-dhe-10.txt

[Ilari Liusvaara <[e-mail]>]

On Fri, Jun 05, 2015 at 10:44:47AM +0200, Nikos Mavrogiannopoulos wrote:
> On Thu, 2015-06-04 at 18:02 -0700, Tony Arcieri wrote:
> > As I expected, one of the major issues seems to be having a backup in 
> > the event of a catastrophic failure of ECC:
> > On Mon, Jun 1, 2015 at 4:02 PM, Tony Arcieri <[e-mail]> 
> > wrote:
> > > I expect the response is going to be "What if there's some 
> > > catastrophic failure of ECC?"
> > > 
> > On Wed, Jun 3, 2015 at 1:05 AM, Dave Garrett <[e-mail]>
> >  wrote:
> > > People want a backup to deal with mistrust of ECC curves
> > On Wed, Jun 3, 2015 at 3:05 AM, Nikos Mavrogiannopoulos <
> > [e-mail]> wrote:
> > > Removing the negotiation option means there there will
> > > be no backup at all in case of a flaw in the existing ECDHE
> > > ciphersuites.
> > When I did a quick straw poll of the CFRG about this, the seemingly 
> > unanimous preference was if we do want to solve the general problem 
> > of an "ECC backup", we should be focusing on post-quantum algorithms, 
> > not shoring up FFDHE.
> 
> I agree, but I don't see any proposals so far. Once we have such an
> algorithm as backup we can drop FFDHE.

Unfortunately, PQ algorithms (and there do seem to be PQ key agreement
algorithms that look sufficiently like Diffie-Hellman) are much less
understood than DH or ECDH.

Some relevant questions:
- How much assurance there is to security of such scheme in general?
- Approximately how fast the scheme runs (at least that it isn't
  hopelessly slow)?
- How does exchange key size scale as function of estimated security
  level (especially as TLS is currently limited to 64kB keys, and PQ
  schemes tend to have very large keys)?
- What mesages does the scheme need (especially, is it one from each
  in either order DH/ECDH has)?
- Can the scheme use fixed sets of public paramters (especially as
  TLS 1.3 key exchange has that limit)?
- How to perform trustworthy generation of the public parameters
  (some schemes have serious problems there)?
- What regions of public parameters to avoid because of security
  issues?


I don't know if this is even CFRG material at this point, let alone
material for TLS WG.


-Ilari