IETF Logo Mail Archive

Re: [TLS] Adoption call for Deprecating FFDH(E) Ciphersuites in TLS

Carrick Bartle <cbartle891@icloud.com> Fri, 30 July 2021 20:25 UTC

Return-Path: <cbartle891@icloud.com>
X-Original-To: tls@ietfa.amsl.com
Delivered-To: tls@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 181083A0E91 for <tls@ietfa.amsl.com>; Fri, 30 Jul 2021 13:25:16 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.845
X-Spam-Level:
X-Spam-Status: No, score=-1.845 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_ENVFROM_END_DIGIT=0.25, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=icloud.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ocgaqqs8xaeo for <tls@ietfa.amsl.com>; Fri, 30 Jul 2021 13:25:11 -0700 (PDT)
Received: from mr85p00im-ztdg06011201.me.com (mr85p00im-ztdg06011201.me.com [17.58.23.181]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5D8E03A0E8C for <tls@ietf.org>; Fri, 30 Jul 2021 13:25:11 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=icloud.com; s=1a1hai; t=1627676711; bh=wexm4k3Nqc8pbCZn4ojRJ/efzfqGYNqB2dKssTUtkx4=; h=From:Message-Id:Content-Type:Mime-Version:Subject:Date:To; b=PZfrTlk/0WltQvJuiLoJhVsytlw/m03cB5Muvyr/IcfWYs7gFxZ0voCZh0LUlghBM WPYhVUPKiMzJvv3owOpCAAZdydcyc+isV1Hu01iLUF6P+5AVErk9IKYTMukgNZwhZC 3YPcd58nDfFz6CG2aMr06z+DszD2i/A6P81YgdqqqUvNNxx7zmgCE/hmQYnsfwpGiH 7Qw8bZdn8Bv4sbThAjI4PI2oquqEEbdSy+pQw5RwzdPd6/qzrr+0YreljNgawPq8Rg g3ux6qApnxAsBdYA4oHiNVJ8g6tNj8XZMb+yCn/d36Bp7jeD2i9tn2R6xwZTemobQS 6/QCqWfFiI5nw==
Received: from smtpclient.apple (unknown [17.11.172.221]) by mr85p00im-ztdg06011201.me.com (Postfix) with ESMTPSA id 98B4D4000DA; Fri, 30 Jul 2021 20:25:10 +0000 (UTC)
From: Carrick Bartle <cbartle891@icloud.com>
Message-Id: <42825587-F7A0-4972-9A33-BDEE68123446@icloud.com>
Content-Type: multipart/alternative; boundary="Apple-Mail=_167EA809-350E-4980-8F4F-3ACCEB17C1BA"
Mime-Version: 1.0 (Mac OS X Mail 14.0 \(3654.80.0.2.43\))
Date: Fri, 30 Jul 2021 13:25:10 -0700
In-Reply-To: <1f86d146-92a1-4175-985f-92705d077d7c@www.fastmail.com>
Cc: tls@ietf.org
To: Martin Thomson <mt@lowentropy.net>
References: <CAOgPGoC4C0bWz0h0iyzGzMPEoDKAPv4euoOkmS+6Uuxncux4Zg@mail.gmail.com> <1f86d146-92a1-4175-985f-92705d077d7c@www.fastmail.com>
X-Mailer: Apple Mail (2.3654.80.0.2.43)
X-Proofpoint-Virus-Version: vendor=fsecure engine=1.1.170-22c6f66c430a71ce266a39bfe25bc2903e8d5c8f:6.0.391,18.0.790,17.0.607.475.0000000 definitions=2021-07-30_08:2021-07-30_01,2021-07-30_08,2020-04-07_01 signatures=0
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 mlxscore=0 clxscore=1015 spamscore=0 phishscore=0 suspectscore=0 adultscore=0 bulkscore=0 malwarescore=0 mlxlogscore=999 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2009150000 definitions=main-2107300138
Archived-At: <https://mailarchive.ietf.org/arch/msg/tls/wjYO-AEYIP1St-C-nOmRypQEIJU>
Subject: Re: [TLS] Adoption call for Deprecating FFDH(E) Ciphersuites in TLS
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/tls/>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 30 Jul 2021 20:25:16 -0000

Hi Martin,

Actually, a clarification question (more relevant to the other thread <https://mailarchive.ietf.org/arch/browse/tls/?q=Adoption%20call%20for%20Deprecating%20Obsolete%20Key%20Exchange%20Methods%20in%20TLS> : are you opposed to fully deprecating FFDHE? If so, why?


> On Jul 29, 2021, at 5:41 PM, Martin Thomson <mt@lowentropy.net> wrote:
> 
> I support the *contents* of this document.  The title, however, I can't agree to.  So I want to be clear about the scope of the work, namely deprecating semi-static FFDH and ECDH suites and any use of FFDHE ephemeral suites with reused keys.
> 
> The draft limits the ban on ephemeral key reuse to FFDHE, which is right; I could tolerate a prohibition on reuse for ECDH, but I know that we rely on that for HPKE and other things, so it can't really be bad enough to ban.
> 
> Cheers,
> Martin
> 
> On Fri, Jul 30, 2021, at 07:50, Joseph Salowey wrote:
>> This is a working group call for adoption for Deprecating FFDH(E) 
>> Ciphersuites in TLS (draft-bartle-tls-deprecate-ffdhe-00 
>> <https://datatracker.ietf.org/doc/draft-bartle-tls-deprecate-ffdhe/ <https://datatracker.ietf.org/doc/draft-bartle-tls-deprecate-ffdhe/>>). 
>> We had a presentation for this draft at the IETF 110 meeting and since 
>> it is a similar topic to the key exchange deprecation draft the chairs 
>> want to get a sense if the working group wants to adopt this draft 
>> (perhaps the drafts could be merged if both move forward).  Please 
>> review the draft and post your comments to the list by Friday, August 
>> 13, 2021.  
>> 
>> Thanks,
>> 
>> The TLS chairs
>> _______________________________________________
>> TLS mailing list
>> TLS@ietf.org
>> https://www.ietf.org/mailman/listinfo/tls
>> 
> 
> _______________________________________________
> TLS mailing list
> TLS@ietf.org <mailto:TLS@ietf.org>
> https://www.ietf.org/mailman/listinfo/tls <https://www.ietf.org/mailman/listinfo/tls>

v2.23.0 | Report a Bug | By Email