Re: [TLS] New Algorithm identifier for EDH > 1024 bits?

On Thu, Sep 26, 2013 at 7:15 AM, Phillip Hallam-Baker <hallam@gmail.com> wrote:
> My understanding of the 1024 bit Ephemeral DH key issue is that it is not
> currently possible to use longer keys because a certain number of deployed
> Web servers will abort the connection if a client presents a longer key.

The size of ephemeral DH keys is specified by the server, and the
client must present a key of that size. (This doesn't change the
problem though.)

The client needs a way to negotiate the ephemeral DH key size (or the
DH domain parameters) with the server. This can be done by either an
extension (similar to the elliptic_curves extension of RFC 4492 for
ephemeral ECDH keys) or new cipher suites.

Wan-Teh Chang

>
> Hmmm, wonder who made that decision...
>
>
> Regardless, this is not a problem that will solve itself. Even if presenting
> a longer key will cause a connection to abort in 0.1% of cases, browsers are
> not going to make the attempt. So if nothing is done the legacy servers will
> prevent use of longer DH keys for the next 20+ years.
>
> I don't think a TLS version number upgrade is the solution either. It is
> just a bad idea for an algorithm suite identifier to mean one thing in TLS
> 1.2 and another in TLS 1.3.
>
>
> The simple solution to this problem in my view is to specify a new algorithm
> suite identifier for DH larger than 1024 and use that in parallel. That
> might get us to a point where 25% of Web Servers are using very strong EDH
> within 12-24 months.
>
>
> --
> Website: http://hallambaker.com/
>
> _______________________________________________
> TLS mailing list
> TLS@ietf.org
> https://www.ietf.org/mailman/listinfo/tls
>