Re: [TLS] AD review of draft-ietf-tls-negotiated-ff-dhe-08

[Daniel Kahn Gillmor <[e-mail]>]

On Wed 2015-04-01 22:05:17 -0400, Martin Rex wrote:
> The problem with the quoted requirement in rfc4492 is (similar to several
> highly bogus and/or overbroad requirements in other TLS-related RFCs),
> that it does not distinguish PDU content from communication peer behaviour,
> and does not declare whether that requirement applies only to sender
> or also to recipient.

This suggestion seems to imply that we should be relaxing this
requirement (we've relaxed other overeager requirements in TLS that just
cause interop failure), which, iiuc, is what Stephen was proposing also.

> The result is, that there may easily exist server implementation of rfc4492
> which abort the TLS handshake when they receive a TLS ClientHello with
> the TLS ECC named_curve extension (and only ffdhe named curves in it)
> but no accompanying ECC cipher suites in the ClientHello cipher_suites_list,
> and that interoperability failure OUGHT to be avoided.  REALLY.

If you know of any server implementations that do this, please point me
(and/or the list) to them.

    --dkg