Re: [TLS] Still missing: TLS_ECDH_anon_WITH_AES_xxx_GCM_SHAxxx

[Kurt Roeckx <[e-mail]>]

On Thu, Mar 13, 2014 at 08:23:45PM +0100, Martin Rex wrote:
> I strongly frown upon the idea of resurrecting DH_anon cipher suites
> from their cold grave, let alone adding new cruft.
> 
> Generate Server Keys on the fly just like SSH does.  Resurrecting
> DH_anon turns an initial-leap-of-faith into eternal-leaps-of-faith.

You can't do authenticated encryption with SMTP in most of the
cases.  DANE is currently about the best way to move to
authenticated encrypted SMTP, however there are very few sites
that bother to set up DNSSEC and DANE.

Since it's SMTP is now not authenticated it makes perfect sense to
use anonymous DH.  The best option for that is currently
TLS_DH_anon_WITH_AES_XXX-GCM-SHAXXX, and this would add the ECDH
version.

I would agree that moving to authenticated encryption would be the
best, but since we can't do authenticated encryption we should go
for the best thing we can do without authentication, and that
would be this proposal.

I'm not sure what you mean with your comment about SSH, but I do
hope that you actually check the fingerprint of the host you're
connecting to.


Kurt