Re: [TLS] AD review of draft-ietf-tls-negotiated-ff-dhe-08

[Daniel Kahn Gillmor <[e-mail]>]

On Fri 2015-04-03 16:48:26 -0400, Stephen Farrell wrote:
> It's not that I disagree with 'em, but I don't find them
> that compelling tbh. The best (to me) seems to be that
> additional usage in multiple protocols makes for a more
> attractive target. But the MODP groups are already used
> in TLS, and naming them in this way might reduce the
> liklihood that some implementation accepts groups without
> checking 'em.

The MODP groups are not explicitly used anywhere in the TLS specs
(though of course nothing prevents a TLS server from chooing to use one
of them).  Some of the MODP groups (with different generators in some
cases) are used in TLS SRP (this is not the standard FFDHE handshake),
but aiui, we're talking about killing off SRP anyway.

> (E.g. an updated client would have the code to check that a
> known-named group has been selected by the server, so might benefit
> even if the server hasn't been updated).

If it were already common practice to use strong MODP groups for FFDHE,
this might be a convincing argument.  But in the surveys i've seen, most
DHE implementations restrict themselves to 1024-bit FFDHE anyway,
possibly due to client incompatibility or lack of understanding of the
protocol.  Whether that's MODP 1024 or some other 1024-bit DHE group,
this is still too weak for most guarantees i'd like to see TLS be able
to make.

> However, let's proceed and please treat the above as just
> another last call comment. In this case, you've responded
> already so if nobody else wants to pursue the discussion
> then we'll be all set.

sounds good to me.  thanks for the review and the feedback, Stephen.

       --dkg