Re: [TLS] DHE key derivation

[Yaron Sheffer <[e-mail]>]

On 09/27/2013 07:55 PM, Hanno Böck wrote:
> On Fri, 27 Sep 2013 18:07:42 +0300
> Yaron Sheffer <[e-mail]> wrote:
>
>> While we're opening (maybe) the negotiation of DHE, I'd like to
>> clarify an issue that bothers me in the implementation of DHE in TLS:
>>
>> With DHE, the premaster secret depends only on the DH shared secret.
>> We know that DHE is commonly used with 1024-bit parameters. So even
>> if you have a 2048-bit RSA certificate, the session strength will be
>> 1024 bits.
>>
>> What if we mixed *both* the DH secret and the regular encrypted nonce
>> that's used in RSA ciphersuites into the premaster secret? Wouldn't
>> we get forward secrecy, as well as crypto strength equivalent to the
>> higher of the two lengths?
>
> I feel this would add even more confusion.
>
> What you'd get:
> - Connection Security of the RSA key size, BUT
> - Forward Secrecy only with the security of the DHE modulus size
>
> Or to be concrete: an attacker able to steal the certificate's key
> AFTER recording a connection and at the same time being able to break
> the DHE would still be able to decrypt.
>
> I don't really get why that should make any sense. Okay, it would avoid
> that DHE "downgrades" the security of the RSA key.
> But: This would require changes to the protocol. Won't work with
> existing software, so it won't solve the mess we have today.
>
> If you are already changing the protocol, you can also do something
> that makes much more sense: Forbid DHE modulus size smaller than RSA
> key size. (which also could be achieved just by server policy without
> protocol changes, but then breaks messy clients like java - see past
> discussion)
>
Hi Hanno,

Just a few weeks ago we as a community thought the server's private key 
was generally secure. Now the entire community seems to assume the 
private key is easy to steal. Practically, most private keys will 
probably not be stolen. OTOH the NSA (and also much smaller 
organizations) will have a pile of DH-1024 encrypted traffic for years 
to come just waiting for compute power to enable decryption en masse.

I'm sure you're not seriously suggesting that if I have a 3072-bit RSA 
cert, but my crypto library can only do 2048-bit DH, then I should never 
do DHE, and instead fall back to simple RSA, are you? Looking forward, 
there will always be mismatches and we should prefer the best possible 
TLS "mix", rather than enforce an idealistic policy.

Thanks,
	Yaron