Re: [TLS] The risk of misconfiguration

[Daniel Kahn Gillmor <[e-mail]>]

On 05/07/2014 01:38 PM, Alyssa Rowan wrote:
> For opportunistic encryption, at least with self-signed cert usage we
> can then softly migrate from opportunistic to DANE-EE pinning - and
> indeed that is the route SMTP has already taken, as Viktor's helpfully
> highlighted.

this soft migration can happen by moving from anonymous key exchanges to
non-anonymous key exchanges when they publish their DANE-EE pin, though.

> Meanwhile aDH denies us that option, and broadcasts our MITM
> susceptibility to Mallory.

I think this is more an argument that the ciphersuite negotiation
shouldn't be in the clear than it is an argument to reject an aDHE key
exchange scheme.

I recognize that there are chicken-and-egg issues here, but it seems
possible to protect the handshake itself with a non-negotiable
mandatory-to-implement scheme that protects at least against passive
monitoring, and then allow the rest of the communication the flexibility
for algorithm agility.

With proper traffic padding, this would avoid broadcasting any
MITM-susceptibility to Mallory without Mallory actively making a
(potentially detectable) MITM attack herself.

	--dkg