Re: [TLS] DH group negotiation extension [was: Re: draft-sheffer-tls-bcp: DH recommendations]

[Patrick Pelletier <[e-mail]>]

On 11/7/13 1:33 AM, Daniel Kahn Gillmor wrote:

> The minmalist proposal:
> -----------------------
>
>   * compliant clients advertising a ciphersuite using EDH would include
>     an extension indicating the smallest and largest EDH group sizes they
>     are willing to accept.

The only thing I would add is that besides minimum and maximum number of 
bits, the client should also indicate a multiple, which the group size 
must be divisible by.  For example, Java only supports DH groups whose 
size is a multiple of 64.  If the client can accept any group size 
within its minimum,maximum range, then it uses 1 as its multiple.  So, 
examples of this triple might be:

1024,2048,64
1280,4096,8
1024,8192,1

> All of the observations above make me think that the minimalist proposal
> seems to be the least likely to cause controversy and the simplest to
> patch into existing implementations quickly and safely.

+1.  It just fixes the existing mechanism, rather than introducing a new 
mechanism.

However, at the risk of making the minimalist proposal slightly less 
minimal, I'd like to suggest that the extension should also allow the 
server to reply with the DH exponent size:

http://lists.gnutls.org/pipermail/gnutls-help/2012-May/002748.html

--Patrick