Re: [TLS] Still missing: TLS_ECDH_anon_WITH_AES_xxx_GCM_SHAxxx

[Yaron Sheffer <[e-mail]>]

Hi Nico,

this is about much more than anon-DH cipher suites. The proposal that if 
the client doesn't see a DANE certificate, it can initiate a TLS 
connection with (only) anon-DH means that even if the server does have a 
PKIX certificate (maybe it's old and has not heard of TLSA yet:-), the 
client will not be able to get an authenticated connection with it. So 
we will probably need these cipher suites combined with additional TLS 
signaling, as well as certificate pinning, to allow clients to juggle 
securely between authenticated and anonymous TLS.

Thanks,
	Yaron

On 03/13/2014 07:02 AM, Nico Williams wrote:
[...]

>
> In the SMTP case when there's no TLSA RRs in the DNS for the server
> and the server has no certificates, the client may prefer to use anon
> DH/ECDH.  Considering that e-mail has historically had very poor
> privacy protection, that would be a huge step up.  But today an SMTP
> client can't get high-performance ECDH and AEAD ciphers :(