Re: [TLS] Security today

[Eric Rescorla <ekr at networkresonance.com>]

At Sat, 29 Mar 2008 10:31:10 -0700,
Mike wrote:
> 
> >>> 3. The major servers support ephemeral DH, as do many clients.
> >> This is where you are wrong.  Here is a list of servers that will
> >> not negotiate DHE_RSA with any of AES128, AES256, or DES3:
> > 
> > I'm talking about the implementations, not the server operators. 
> > The server operators have chosen not to turn it on.
> 
> And that is precisely why they need a document telling them just
> how damaging that choice is.  Which do you think will get more
> attention, a whitepaper outlining the dangers of not using DHE
> preferentially, written by some random guy named Mike, or the
> same paper with the backing of the TLS WG of the IETF Internet
> Security area?

But the document *does* tell them exactly how damaging the choice
is. It says (S F.1.1.2.):

   With RSA, key exchange and server authentication are combined. The
   public key is contained in the server's certificate.  Note that
   compromise of the server's static RSA key results in a loss of
   confidentiality for all sessions protected under that static key. TLS
   users desiring Perfect Forward Secrecy should use DHE cipher suites.
   The damage done by exposure of a private key can be limited by
   changing one's private key (and certificate) frequently.

You seem to want us to go beyond that to tell them that they should
not use these modes, but that's not our job. 

-Ekr



_______________________________________________
TLS mailing list
TLS at ietf.org
https://www.ietf.org/mailman/listinfo/tls