[TLS] Re: TLS 1.2 draft

Eric Rescorla <ekr@networkresonance.com> writes:

> What I'm saying is that the recommendation to prevent his attack
> is to use an RSA_DHE ciphersuite

I agree with that.  However, if I remember correctly, DHE key
exchanges are generally slower than plain RSA key exchanges with
temporary keys, although it depends on the DH group size.

> and use a fresh DH ephemeral with each key exchange. This provides
> the same security at a substantially superior performance level.

Generating a fresh DH ephemeral with each key exchange would deplete
the entropy in many RNG's.

Perhaps we could discuss the frequency that DH ephemeral's should be
changed, possibly also in the document.

There are tools out there that use a static hard-coded DH ephemeral in
the code, and some configurations where the DH ephemeral is stored in
a separate file, but never re-freshed anyway.

I can't find an appropriate section, but section 8.1.2 seems as good
as any, so I suggest adding this to the end of it:

   When ephemeral DH parameters are needed, they SHOULD be re-freshed
   with some interval appropriate for the local environment.  This MAY
   be for each new key exchange, but MAY also be each day, week or
   month.

That's quite fuzzy, but I'm not sure there are any good
recommendations on this.  In GnuTLS, I think we recommend to change
the DH ephemeral somewhere around each day or week.

The change frequency is related to the size of the DH group, I guess,
and it would be interesting to know what sizes others default to?
GnuTLS uses 1024 bit DHE parameters by default.

/Simon

_______________________________________________
TLS mailing list
TLS@lists.ietf.org
https://www1.ietf.org/mailman/listinfo/tls