Re: [TLS] key sizes in TLS.

[Nikos Mavrogiannopoulos <[e-mail]>]

On Mon, Jun 10, 2013 at 4:08 PM, Dang, Quynh <[e-mail]> wrote:

> I don’t know if it would make sense to specify (1) a method for which the
> client can use to let the server know what key size(s) (DSS or RSA and DH)
> are acceptable and (2) a method for which the server can let the client know
> what key size(s) is/are acceptable to the server for the client's
> authentication.

You are correct. That is an omission from the DHE key exchange in TLS.
At least in gnutls it caused several connection failure issues once we
required a DH group of more than 768 bits in the client.

Overall my impression is that the DHE-based ciphersuites are pretty
much neglected. There are also optimizations that could be done (e.g.,
the server specifying the size of the generator's subgroup), but
no-one ever bothered to update the protocol.

> Even with some (or proposed) ECC-based cipher suites, there is similar issue
> about key sizes for client’s authentication.

Which ones do  you mean? The ECC-based ciphersuites (with named
curves) have the size of the curve hard-coded so I have noticed no
such issues there. In that aspect they are better than their DH
counterparts. If you mean the ECC ciphersuites with explicit curves I
think you should reconsider their usage [0].

regards,
Nikos

[0]. https://www.cosic.esat.kuleuven.be/publications/private/article-2216.pdf