Re: [TLS] draft-sheffer-tls-bcp: DH recommendations

[Ralph Holz <[e-mail]>]

Hi,

> Parameter negotiation seems to be a reasonable (obvious?) bridge to
> higher levels of security. The fact that the server (or the client,
> and even sometime a MITM) can reject these higher key lengths seems
> to be OK with me, the client can choose that to fail a connection
> instead of accepting being downgraded. Even if this results in
> additional round trips, this would be something that people will work
> at removing.
> 
> The following is probably a naïve attempt at a compromise.

[...]

That wouldn't be the scope of the BCP. As Yaron has stated, the aim is a
recommendation that can be followed with what we have, striking a
compromise between PFS (near-must), support in software, and security of
AES. We leave the definition of new extension, or use thereof, to other
drafts.

When we're talking about other ciphers, I'd personally much rather see
Peter's proposal of encrypt-then-MAC, although not as an extension, please.

Ralph

-- 
Ralph Holz
I8 - Network Architectures and Services
Technische Universität München
http://www.net.in.tum.de/de/mitarbeiter/holz/
Phone [phone]
PGP: A805 D19C E23E 6BBB E0C4  86DC 520E 0C83 69B0 03EF