Re: [TLS] TLS 1.2 draft

EKR wrote:
> 
> Martin Rex <martin.rex@sap.com> writes:
> 
> > EKR wrote:
> >> 
> >>      - Remove ephemeral RSA [issue 3]
> >
> > This makes me sad.
> >
> > I would have SIGNIFICANTLY preferred if temporary/ephemeral RSA
> > had been retained and the restriction to the RSA_EXPORT ciphersuites
> > had been removed instead.
> >
> > As I had previously explained, the use of temporary/ephemeral RSA
> > with same-strength keys as the server's certificate would make
> > key-stealing of the servers' key much less useful for passive
> > attacks.
> 
> The recommendation is to use RSA/DHE for these applications. Can
> you explain why you think ephemeral RSA is superior?

The Server's RSA key is typically used for at least one year
(or longer if renewal just extends the cert lifetime and keeps
 the key/keypair).

If an attacker gets hold of the Servers private RSA key, he can
passively monitor (decrypt) all sessions using a RSA-based ciphersuite.

When a temporary/ephemeral keypair is used for key exchange, then
possession of the private RSA key will not be sufficient to
passively monitor (decrypt) SSL sessions with the server
using an RSA ciphersuite with a temporary/ephemeral keypair.
It will require an active (MITM) attack.

-Martin

_______________________________________________
TLS mailing list
TLS@lists.ietf.org
https://www1.ietf.org/mailman/listinfo/tls