]> ACLU

125 Broad Street, 18th Floor New York NY 10004 USA dkg@fifthhorseman.net

General Internet Engineering Task Force Diffie-Hellman, Discrete Logarithm, Transport Layer Security, TLS, Negotiation, Extensions Traditional discrete logarithm-based Diffie-Hellman (DH) key exchange during the TLS handshake suffers from a number of security, interoperability, and efficiency shortcomings. These shortcomings arise from lack of clarity about which DH group parameters TLS servers should offer and clients should accept. This document offers a solution to these shortcomings for compatible peers by establishing a registry of DH parameters with known structure and a mechanism for peers to indicate support for these groups.

Traditional TLS offers a Diffie-Hellman ephemeral (DHE) key exchange mode which provides Perfect Forward Secrecy for the connection. The client offers a ciphersuite in the ClientHello that includes DHE, and the server offers the client group parameters g and p. If the client does not consider the group strong enough (e.g. if p is too small, or if p is not prime, or there are small subgroups), or if it is unable to process it for other reasons, it has no recourse but to terminate the connection. Conversely, when a TLS server receives a suggestion for a DHE ciphersuite from a client, it has no way of knowing what kinds of DH groups the client is capable of handling, or what the client's security requirements are for this key exchange session. Some widely-distributed TLS clients are not capable of DH groups where p > 1024. Other TLS clients may by policy wish to use DHE only if the server can offer a stronger group (and are willing to use a non-PFS key-exchange mechanism otherwise). The server has no way of knowing which type of client is connecting, but must select DHE parameters with insufficient knowledge. Additionally, the DH parameters chosen by the server may have a known structure which renders them secure against small subgroup attack, but a client receiving an arbitrary p has no efficient way to verify that the structure of a new group is reasonable for use. This extension solves these problems with a registry of groups of known reasonable structure, an extension for clients to advertise support for them and servers to select them, and guidance for compliant peers to take advantage of the additional security, availability, and efficiency offered. The use of this extension by one compliant peer when interacting with a non-compliant peer should have no detrimental effects.

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in .

The term "DHE" is used in this document to refer to the discrete-logarithm-based Diffie-Hellman ephemeral key exchange mechanism in TLS. TLS also supports elliptic-curve-based Diffie Hellman ephemeral key exchanges, but this document does not discuss their use. Mentions of DHE here refer strictly to discrete-log-based DHE, and not to ECDHE.

A TLS client that is capable of using strong discrete log Diffie-Hellman groups can advertise its capabilities and its preferences for stronger key exchange by using this mechanism. The client SHOULD send an extension of type "negotiated_dl_dhe_groups" in the ClientHello, indicating a list of known discrete log Diffie-Hellman groups, ordered from most preferred to least preferred. The "extension_data" field of this extension SHALL contain "DiscreteLogDHEGroups" where:

; } DiscreteLogDHEGroups; ]]>

A client that offers this extension SHOULD include at least one DHE-key-exchange ciphersuite in the Client Hello. The known groups defined by the DiscreteLogDHEGroup registry are listed in . These are all safe primes derived from the base of the natural logarithm ("e"), with the high and low 64 bits set to 1 for efficient Montgomery or Barrett reduction. The use of the base of the natural logarithm here is as a "nothing-up-my-sleeve" number. The goal is to guarantee that the bits in the middle of the modulus that they are effectively random, while avoiding any suspicion that the primes have secretly been selected to be weak according to some secret criteria. used pi for this value. See for reasons that this draft does not reuse pi. A client who offers a group MUST be able and willing to perform a DH key exchange using that group.

A TLS server MUST NOT send the NegotiatedDHParams extension to a client that does not offer it first. A compatible TLS server that receives this extension from a client SHOULD NOT select a DHE ciphersuite if it is unwilling to use one of the DH groups named by the client. In this case, it SHOULD select an acceptable non-DHE ciphersuite from the client's offered list. If the extension is present, none of the client's offered groups are acceptable by the server, and none of the client's proposed non-DHE ciphersuites are acceptable to the server, the server SHOULD end the connection with a fatal TLS alert of type insufficient_security. A compatible TLS server that receives this extension from a client and selects a DHE-key-exchange ciphersuite selects one of the offered groups and indicates it to the client in the ServerHello by sending a "negotiated_dl_dhe_groups" extension. The "extension_data" field of this extension on the server side should be a single one-byte value DiscreteLogDHEGroup. A TLS server MUST NOT select a named group that was not offered by the client. If a non-anonymous DHE ciphersuite is chosen, and the TLS client has used this extension to offer a DHE group of comparable or greater strength than the server's public key, the server SHOULD select a DHE group at least as strong as the server's public key. For example, if the server has a 3072-bit RSA key, and the client offers only dldhe2432 and dldhe4096, the server SHOULD select dldhe4096.

When the server sends the "negotiated_dl_dhe_groups" extension in the ServerHello, the ServerDHParams member of the subsequent ServerKeyExchange message should indicate a one-byte zero value (0) in place of dh_g and the identifier of the named group in place of dh_p, represented as a one-byte value. dh_Ys must be transmitted as normal. This re-purposing of dh_p and dh_g is unambiguous: there are no groups with a generator of 0, and no implementation should accept a modulus of size < 9 bits. This change serves two purposes: The size of the handshake is reduced (significantly, in the case of a large prime modulus). The signed struct should not be re-playable in a subsequent key exchange that does not indicate named DH groups.

In a successfully negotiated discrete log DH group key exchange, both peers know that the group in question uses a safe prime as a modulus, and that the group in use is of size p-1 or (p-1)/2. This allows at least three optimizations that can be used to improve performance.

Peers should validate the each other's public key Y (dh_Ys offered by the server or DH_Yc offered by the client) by ensuring that 1 < Y < p-1. This simple check ensures that the remote peer is properly behaved and isn't forcing the local system into a small subgroup. To reach the same assurance with an unknown group, the client would need to verify the primality of the modulus, learn the factors of p-1, and test Y against each factor.

Traditional Discrete Log Diffie-Hellman has each peer choose their secret exponent from the range [2,p-2]. Using exponentiation by squaring, this means each peer must do roughly 2*log_2(p) multiplications, twice (once for the generator and once for the peer's public key). Peers concerned with performance may also prefer to choose their secret exponent from a smaller range, doing fewer multiplications, while retaining the same level of overall security. Each named group indicates its approximate security level, and provides a lower-bound on the range of secret exponents that should preserve it. For example, rather than doing 2*2*2432 multiplications for a dldhe2432 handshake, each peer can choose to do 2*2*224 multiplications by choosing their secret exponent in the range [2,2^224] and still keep the approximate 112-bit security level. A similar short-exponent approach is suggested in SSH's Diffie-Hellman key exchange (See section 6.2 of ).

Peers wishing to further accelerate DHE key exchange can also pre-compute a table of powers of the generator of a known group. This is a memory vs. time tradeoff, and it only accelerates the first exponentiation of the ephemeral DH exchange (the exponentiation using the peer's public exponent as a base still needs to be done as normal).

[This section should be removed, and questions resolved, before any formalization of this draft]

Some servers will support this extension, but for whatever reason decide to not negotiate a ciphersuite with DHE key exchange at all. Some possible reasons include: The client indicated that a server-supported non-DHE ciphersuite was preferred over all DHE ciphersuites, and the server honors that preference. The server prefers a client-supported non-DHE ciphersuite over all DHE ciphersuites, and selects it unilaterally. The server would have chosen a DHE ciphersuite, but none of the client's offered groups are acceptable to the server, Clients will not know that such a server supports the extension. Should we offer a way for a server to indicate its support for this extension to a compatible client in this case? Should the server have a way to advertise that it supports this extension even if the client does not offer it?

Is there any reason to include a weak group in the list of groups? Most DHE-capable peers can already handle 1024-bit DHE, and therefore 1024-bit DHE does not need to be negotiated. Properly-chosen 2432-bit DH groups should be roughly equivalent to 112-bit security. And future implementations should use sizes of at least 3072 bits according to .

This spec currently doesn't indicate any support for groups other than the named groups. Other DHE specifications have moved away from staticly-named groups with the explicitly-stated rationale of reducing the incentive for precomputation-driven attacks on any specific group (e.g. section 1 of ). However, arbitrary large groups are expensive to transmit over the network and it is computationally infeasible for the client to verify their structure during a key exchange. If we instead allow the server to propose arbitrary groups, we could make it a MUST that the generated groups use safe prime moduli, while still allowing clients to signal support (and desire) for large groups. This leaves the client in the position of relying on the server to choose a strong modulus, though. Note that in at least one known attack against TLS , a malicious server uses a deliberately broken discrete log DHE group to impersonate the client to a different server.

Thanks to Fedor Brunner, Dave Fergemann, Sandy Harris, Watson Ladd, Nikos Mavrogiannopolous, Niels Möller, Kenny Paterson, and Tom Ritter for their comments and suggestions on this draft. Any mistakes here are not theirs.

This document defines a new TLS extension, "negotiated_dh_group", assigned a value of XXX from the TLS ExtensionType registry defined in section 12 of . This value is used as the extension number for the extensions in both the client hello message and the server hello message. defines a TLS Discrete Log DHE Named Group Registry. Each entry in this registry indicates the group itself, its derivation, its expected strength (estimated roughly from guidelines in ), and whether it is recommended for use in TLS key exchange at the given security level. This registry may be updated by the addition of new discrete log groups, and by reassessments of the security level or utility to TLS of any already present group. Updates are made by IETF Review, and should consider .

Because the contents of this extension is hashed in the finished message, an active MITM that tries to filter or omit groups will cause the handshake to fail, but possibly not before getting the peer to do something they would not otherwise have done. An attacker who impersonates the server can try to do any of the following: Pretend that a non-compatible server is actually capable of this extension, and select a group from the client's list, causing the client to select a group it is willing to negotiate. It is unclear how this would be an effective attack. Pretend that a compatible server is actually non-compatible by negotiating a non-DHE ciphersuite. This is no different than MITM ciphersuite filtering. Pretend that a compatible server is actually non-compatible by negotiating a DHE ciphersuite and no extension, with an explicit (perhaps weak) group chosen by the server. [XXX what are the worst consequences in this case? What might the client leak before it notices that the handshake fails? XXX] An attacker who impersonates the client can try to do the following: Pretend that a compatible client is not compliant (e.g. by not offering this extension). This could cause the server to negotiate a weaker DHE group during the handshake, but it would fail to complete during the final check of the Finished message. Pretend that a non-compatible client is compatible. This could cause the server to send what appears to be an extremely odd ServerDHParams (see ), and the check in the Finished message would fail. It is not clear how this could be an attack. Change the list of groups offered by the client (e.g. by removing the stronger of the set of groups offered). This could cause the server to negotiate a weaker group than desired, but again should be caught by the check in the Finished message.

Note that this extension specifically targets only discrete log-based Diffie-Hellman ephemeral key exchange mechanisms. It does not cover the non-ephemeral DH key exchange mechanisms, nor does it cover elliptic curve-based DHE key exchange, which has its own list of named groups.

Advances in hardware or in discrete log cryptanalysis may cause some of the negotiated groups to not provide the desired security margins, as indicated by the estimated work factor of an adversary to discover the premaster secret (and therefore compromise the confidentiality and integrity of the TLS session). Revisions of this extension or updates should mark known-weak groups as explicitly deprecated for use in TLS, and should update the estimated work factor needed to break the group, if the cryptanalysis has changed. Implementations that require strong confidentiality and integrity guarantees should avoid using deprecated groups and should be updated when the estimated security margins are updated.

Other lists of named discrete log Diffie-Hellman groups exist. This draft chooses to not reuse them for several reasons: Using the same groups in multiple protocols increases the value for an attacker with the resources to crack any single group. The IKE groups include weak groups like MODP768 which are unacceptable for secure TLS traffic. Mixing group parameters across multiple implementations leaves open the possibility of some sort of cross-protocol attack. This shouldn't be relevant for ephemeral scenarios, and even with non-ephemeral keying, services shouldn't share keys; however, using different groups avoids these failure modes entirely. Other lists of named DL DHE groups are not collected in a single IANA registry, or are mixed with non-DL DHE groups, which makes them inconvenient for re-use in a TLS DHE key exchange context.

Any implementation of discrete log Diffie-Hellman key exchange should use constant-time modular-exponentiation implementations. This is particularly true for those implementations that ever re-use DHE secret keys (so-called "semi-static" ephemeral keying) or share DHE secret keys across a multiple machines (e.g. in a load-balancer situation).

shows a malicious peer using a bad DL DHE group to maneuver a client into selecting a pre-master secret of the peer's choice, which can be replayed to another server using a non-DHE key exchange, and can then be bootstrapped to replay client authentication. To prevent this attack (barring the fixes proposed in ), a client would need not only to implement this draft, but also to reject non-negotiated DL DHE ciphersuites whose group structure it cannot afford to verify. Such a client would need to abort the initial handshake and reconnect to the server in question without listing any DL DHE ciphersuites on the subsequent connection. This tradeoff may be too costly for most TLS clients today, but may be a reasonable choice for clients performing client certificate authentication, or who have other reason to be concerned about server-controlled pre-master secrets.

This extension provides a few additional bits of information to distinguish between classes of TLS clients (see e.g. ). To minimize this sort of fingerprinting, clients SHOULD support all named groups at or above their minimum security threshhold. New named groups SHOULD NOT be added to the registry without consideration of the cost of browser fingerprinting.

&RFC2119; &RFC3526; &RFC4419; &RFC5226; &RFC5246; European Union Agency for Network and Information Security Agency European Network of Excellence in Cryptology II Strongswan Strongswan INRIA INRIA INRIA INRIA INRIA INRIA Google Microsoft Electronic Frontier Foundation

The primes in these discrete log groups are all safe primes, that is, a prime p is a safe prime when q = (p-1)/2 is also prime. Where e is the base of the natural logarithm, and square brackets denote the floor operation, the groups which initially populate this registry are derived for a given bitlength b by finding the lowest positive integer X that creates a safe prime p where:

New additions to this registry may use this same derivation (e.g. with different bitlengths) or may choose their parameters in a different way, but must be clear about how the parameters were derived.

The 2432-bit group has registry value 0, and is calcluated from the following formula: The modulus is: p = 2^2432 - 2^2368 + {[2^2302 * e] + 2111044} * 2^64 - 1 Its hexadecimal representation is:

The generator is: g = 2 The group size is (p-1)/2 The estimated symmetric-equivalent strength of this group is 112 bits. Peers using dldhe2432 that want to optimize their key exchange with a short exponent should choose a secret key of at least 224 bits.

The 3072-bit prime has registry value 1, and is calcluated from the following formula: p = 2^3072 - 2^3008 + {[2^2942 * e] + 2625351} * 2^64 -1 Its hexadecimal representation is:

The generator is: g = 2 The group size is: (p-1)/2 The estimated symmetric-equivalent strength of this group is 125 bits. Peers using dldhe3072 that want to optimize their key exchange with a short exponent should choose a secret key of at least 250 bits.

The 4096-bit group has registry value 2, and is calcluated from the following formula: The modulus is: p = 2^4096 - 2^4032 + {[2^3966 * e] + 5736041} * 2^64 - 1 Its hexadecimal representation is:

The base is: g = 2 The group size is: (p-1)/2 The estimated symmetric-equivalent strength of this group is 150 bits. Peers using dldhe4096 that want to optimize their key exchange with a short exponent should choose a secret key of at least 300 bits.

The 6144-bit group has registry value 3, and is calcluated from the following formula: The modulus is: p = 2^6144 - 2^6080 + {[2^6014 * e] + 15705020} * 2^64 - 1 Its hexadecimal representation is:

The generator is: 2 The group size is: (p-1)/2 The estimated symmetric-equivalent strength of this group is 175 bits. Peers using dldhe6144 that want to optimize their key exchange with a short exponent should choose a secret key of at least 350 bits.

The 8192-bit group has registry value 4, and is calcluated from the following formula: The modulus is: p = 2^8192 - 2^8128 + {[2^8062 * e] + 10965728} * 2^64 - 1 Its hexadecimal representation is:

The base is: g = 2 The group size is: (p-1)/2 The estimated symmetric-equivalent strength of this group is 192 bits. Peers using dldhe8192 that want to optimize their key exchange with a short exponent should choose a secret key of at least 384 bits.