Re: [TLS] DSS with other than SHA-1 algorithms

[Juho Vähä-Herttua <[e-mail]>]

On May 11, 2011, at 5:31 AM, Peter Gutmann wrote:
> Nikos Mavrogiannopoulos <[e-mail]> writes:
>> According to me this study would be an argument for the _RSA ecc ciphersuites
>> rather than the ECDSA.
> 
> Why?  The draft contains the combinations of parameters and options that
> everything seems to support and everything seems to get right.  Why the
> obsession with _RSA?

I wouldn't want to repeat myself and I certainly am not obsessed with _RSA (because in all ways it is a bad solution), but do you have any data about which implementations didn't support or "get right" the _RSA ciphersuites? 

ECDH and ECDSA are basically the same calculation (EC point multiplication), so it makes much more sense to do ECDHE_ECDSA from idealistic point of view, but the motivation seems to be purely practical. The fact is that I can only get RSA certificates from my CA, so if I want forward secrecy I need to do either DHE_RSA or ECDHE_RSA.

> (Note, if you can document support for, and interoperability among, Microsoft,
> NSS, OpenSSL, and one or two other implementations, for _RSA, I'll be happy to
> add it).

Microsoft documents them on their website as supported, OpenSSL should support them as well and NSS based browsers (at least Firefox) are offering them in ClientHello by default. I can go to do some interoperability testing, but before that I would like to know did you ever test the _RSA ciphersuites? I think it is rather rude when people present a perfectly valid question and the response is to call them obsessive. And I would love to get some data about how _RSA suites fail so I wouldn't have to do any tests, but I think this question is completely in the scope of the draft and should be resolved before releasing it. It seems the motivation of dropping _RSA suites is either because they don't interoperate (for a reason that is difficult for me to see) or because the author rightly believes they are crap and not worth documenting. Either way the motivation should be known.

So to repeat my main point, were the ECDHE_RSA ciphersuites ever tested for interoperability and is the status of their interoperability known? Simple yes or no to both will do and you can ignore everything else I said above.


Juho