Re: [TLS] AD review of draft-ietf-tls-negotiated-ff-dhe-08

[Daniel Kahn Gillmor <[e-mail]>]

On Fri 2015-04-03 13:54:37 -0400, Stephen Farrell wrote:
> On 03/04/15 15:22, Sean Turner wrote:
>> On Mar 31, 2015, at 19:56, Stephen Farrell
>> <[e-mail]> wrote:
>> 
>>> #2 I've never quite gotten the reasoning behind not giving any
>>> names to any of the RFC3526 curves and I think that question
>>> deserves an answer (to be in the list archive). So - why not?
>> 
>> Maybe I’m not following but are you asking that we retroactively name
>> the "4096-bit MODP Group”?
>
> Right, that and any others we still like. The thought is that
> we might get a minor security benefit if the client says that
> they're ok with e.g. the 2048-bit MODP group thereby causing
> some server to not try use a custom group or the old smaller
> groups. (I mean that'd be a minor benefit compared to the
> current situation, not compared to what the draft proposes.)
>
> It's not a major thing as the client can still just check for
> the RFC3626 groups but I'm not sure how likely it is that'd
> be done. OTOH, anyone who updates their code to handle this
> can just as easily adopt the new groups, and I don't think
> there's any particular benefit to sticking with the RFC3526
> groups (e.g. there's no dedicated h/w for those I think).
>
> So if the answer is "yeah, we considered that and didn't like
> it because <foo>" that's fine, I just don't recall having seen
> it on the list.

There are two concrete (and related) answers in the draft as to why
we're not importing several pre-existing named groups:

 https://tools.ietf.org/html/draft-ietf-tls-negotiated-ff-dhe-08#section-9.5
 https://tools.ietf.org/html/draft-ietf-tls-negotiated-ff-dhe-08#section-10.1

Please let me know if there are any changes that could be made to make
the situation more clear, or if you disagree with the rationales.

    --dkg