Re: [TLS] DH group validation

[Nikos Mavrogiannopoulos <nmav at gnutls.org>]

On Tuesday 16 October 2007, Eric Rescorla wrote:

> In the TLS 1.2 standard ciphersuites, a signature authenticates that
> the server really has chosen this particular group.  (Or, in anonymous
> ciphersuites, even *with* group verification you can't really trust
> the DH value if you suspect there might be an active adversary.)  You
> can't verify *all* security-relevant aspects of server behavior, so
> why spend time verifying this particular one?  If the server
> implementation sucks, it could use a perfectly nice DH group in a
> perfectly broken way -- such as by using a low-entropy secret
> exponent.  I don't see that verifying the DH group doesn't really add
> significant value: it does not counter any threats by actual
> adversaries.

I agree with the above. He can post the transaction in plaintext. I don't see 
much to gain by further checking the group.

> Looking at the (purported) group size is reasonable because it is
> cheap to do, so that the client can detect if the server at least
> pretends to use a certain security level.

But of course then you need to define what a security level is and how it 
applies to DH key exchange.


regards,
Nikos



_______________________________________________
TLS mailing list
TLS at lists.ietf.org
https://www1.ietf.org/mailman/listinfo/tls