Re: [TLS] A la carte handshake negotiation

[Dave Garrett <[e-mail]>]

On Friday, June 12, 2015 12:22:37 pm Viktor Dukhovni wrote:
> On Fri, Jun 12, 2015 at 12:13:02PM -0400, Dave Garrett wrote:
> > It might even be warranted to use only DH_anon suites instead
> > of ECDH_anon due to its more widespread use. This would allow usage of
> > ECC without having to specify any new ECDH_anon suites for those lacking
> > them but already having DH_anon suites.
> 
> I'm afraid I don't understand the above.  Also AECDH (ECDH_anon)
> is not particularly rare:
> 
>     Jun 12 15:48:16 mournblade postfix/smtpd[25717]: Anonymous TLS connection established from xmpp.openssl.org[194.97.150.230]: TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)

Your quote is usage of:
TLS_ECDH_anon_WITH_AES_256_CBC_SHA

AES CBC already cannot be used with TLS 1.3+, as it now requires AEAD ciphers only.

TLS_DH_anon_WITH_AES_256_GCM_SHA384 is in:
https://tools.ietf.org/html/rfc5288

TLS_ECDH_anon_WITH_AES_256_GCM_SHA384 is in this expired draft:
https://tools.ietf.org/html/draft-williams-tls-anon-ecdh-modern-cipher-01

The current proposal requires all suites for TLS 1.3+ to be the ECC variants, which is not currently doable for anon AES-GCM. What I'm saying is that we could use "DH_anon" suites instead of "ECDH_anon" suites in this scheme. Just properly publishing a "ECDH_anon" RFC would be preferable, however.


Dave