Re: [TLS] I-D Action: draft-ietf-tls-negotiated-ff-dhe-00.txt

[Yoav Nir <[e-mail]>]

On Jul 24, 2014, at 10:53 AM, Peter Gutmann <[e-mail]> wrote:

> <[e-mail]> writes:
> 
>>  Traditional finite-field-based Diffie-Hellman (DH) key exchange
>>  during the TLS handshake suffers from a number of security,
>>  interoperability, and efficiency shortcomings.  These shortcomings
>>  arise from lack of clarity about which DH group parameters TLS
>>  servers should offer and clients should accept.  This document offers
>>  a solution to these shortcomings for compatible peers by establishing
>>  a registry of DH parameters with known structure and a mechanism for
>>  peers to indicate support for these groups.
> 
> Some comments:
> 
> - Why not just use the well-known and -accepted IKE groups from RFC 3526 for
> this?  In fact why invent entirely new groups (that don't even cover the
> existing range in RFC 3526) when there's already well-established ones
> available?

That’s been asked at the meeting. No particular answer.

> - What's the thinking behind a 2432-bit group?  2048-bit I could understand,
> 2560 bits perhaps, but 2432?

I asked that at the meeting. The answer is that this number supposedly exactly matches the 112-bit level of security. 

> - Publishing the values of q (rather than just telling people how to calculate
> them) would be good, since it'd provide known-correct values for them.
> 
> In general though, we don't need yet another set of parameters, all that's
> needed is a mechanism for specifying the existing RFC 3526 groups.

And that’s assuming we even want FFC parameters (as opposed to ECC).

Yoav