Re: [TLS] I-D Action: draft-ietf-tls-negotiated-ff-dhe-00.txt

[Peter Gutmann <[e-mail]>]

<[e-mail]> writes:

>   Traditional finite-field-based Diffie-Hellman (DH) key exchange
>   during the TLS handshake suffers from a number of security,
>   interoperability, and efficiency shortcomings.  These shortcomings
>   arise from lack of clarity about which DH group parameters TLS
>   servers should offer and clients should accept.  This document offers
>   a solution to these shortcomings for compatible peers by establishing
>   a registry of DH parameters with known structure and a mechanism for
>   peers to indicate support for these groups.

Some comments:

- Why not just use the well-known and -accepted IKE groups from RFC 3526 for
this?  In fact why invent entirely new groups (that don't even cover the
existing range in RFC 3526) when there's already well-established ones
available?

- What's the thinking behind a 2432-bit group?  2048-bit I could understand,
2560 bits perhaps, but 2432?

- Publishing the values of q (rather than just telling people how to calculate
them) would be good, since it'd provide known-correct values for them.

In general though, we don't need yet another set of parameters, all that's
needed is a mechanism for specifying the existing RFC 3526 groups.

Peter.