Re: [TLS] FFDHE and SHOULDs on usage

[Bodo Moeller <[e-mail]>]

Martin Thomson <[e-mail]>:

The draft says that, for servers:
>
>    If a compatible TLS server receives a Supported Groups extension from
>    a client that includes any FFDHE group (i.e. any codepoint between
>    256 and 511 inclusive, even if unknown to the server), and if none of
>    the client-proposed FFDHE groups are known and acceptable to the
>    server, then the server SHOULD NOT select an FFDHE ciphersuite.
>
> I think that this needs to be a MUST.  If the client is willing to
> take the servers choice of group, then it would not be including the
> fixed groups.
>


> NEW:
>    The compatible client that wants to be able to negotiate strong FFDHE
>    sends a "Supported Groups" extension
> Rationale:
>    This is purely axiomatic.



> NEW:
>    A client that offers a NamedCurve extension containing a FFDHE group
>    cannot use
> Rationale:
>    No need for normative language here, this is purely a (relevant)
> observation.  And "SHOULD ALSO" doesn't appear in RFC 2119 ;)
>

All these suggestions look right to me.

If we really wanted to allow explicitly specified ("PYOG") FFDHE groups as
a fallback, we should create the equivalent of RFC 4492's
arbitrary_explicit_prime_curves NamedCurve. (We don't actually want that, I
hope.)

Bodo