Re: [TLS] The progress about theNegotiated FFDHE proposal

Brian Smith <brian@briansmith.org> Wed, 09 December 2015 19:08 UTC

MIME-Version: 1.0
In-Reply-To: <3074F77D-059D-451B-932E-6B9C07197BA5@sn3rd.com>
References: <CAAgBOhu4151RouRNrCOv8p9PC55nTgdDU28QOEryEF7DHb1BAw@mail.gmail.com> <20151205154330.GA25350@LK-Perkele-V2.elisa-laajakaista.fi> <3074F77D-059D-451B-932E-6B9C07197BA5@sn3rd.com>
Date: Wed, 09 Dec 2015 09:08:34 -1000
Message-ID: <CAFewVt684t0eke+WHtGe2oz1b61QKvCSOEmonhtZ-J+-jHgthA@mail.gmail.com>
From: Brian Smith <brian@briansmith.org>
To: Sean Turner <sean@sn3rd.com>
Content-Type: multipart/alternative; boundary="001a11c3608c21d3e705267bd1f2"
Archived-At: <http://mailarchive.ietf.org/arch/msg/tls/bAOJD281iGc2HuEVq0uUlpYL2Mo>
Cc: "tls@ietf.org" <tls@ietf.org>
Subject: Re: [TLS] The progress about theNegotiated FFDHE proposal
Precedence: list

On Wed, Dec 9, 2015 at 8:44 AM, Sean Turner <sean@sn3rd.com> wrote:

> On Dec 05, 2015, at 10:43, Ilari Liusvaara <ilariliusvaara@welho.com>
> wrote:
> >
> > On Sat, Dec 05, 2015 at 11:32:40PM +0800, Xuelei Fan wrote:
> >> Hi,
> >>
> >> Any one know why the negotiated FFDHE draft hang on MISSREF state for
> more
> >> than 180 days?
> >>
> >>    http://datatracker.ietf.org/doc/draft-ietf-tls-negotiated-ff-dhe/
> >
> > Normatively depends on the false-start draft that isn't sent to the
> > RFC-Editor yet.
> >
> > The specification itself is done and all the needed codepoints have
> > been assigned.
>
> I haven’t see any comments on he 01 version so I’m checking with Bodo to
> see if he got any off list comments.  If not, we’ll get the WGLC started.
>

The FF-DHE draft should be reset so that it specifies new cipher suite IDs
for TLS_DHE_* cipher suites with the same semantics as the current
TLS_DHE_* cipher suites, but with the requirement that the FF-DHE extension
is present (for TLS 1.2 and earlier versions). As predicted long ago, the
current design of this extension doesn't make sense because it doesn't
allow for a client to require a strong DHE key and at the same time
maintain compatibility with sites that use weak DHE keys when DHE cipher
suites are offered but which would use a strong non-DHE cipher suite if DHE
cipher suites are not offered.

Additionally, because of the Microsoft SChannel AES-GCM bug from last year,
it is very difficult to deploy a client that uses TLS-DHE-AES-GCM or
TLS-AES-GCM cipher suites. This is more motivation for the proposal in the
previous paragraph.

If the current proposal goes ahead unmodified, I suspect most implementers
will be forced to ignore it and simply turn of TLS_DHE cipher suites
completely. That's what Apple Safari did, what Google Chrome appears to be
doing, and also what Firefox partially did.

If the goal is really to deprecate TLS_DHE cipher suites completely, then
the wording of the draft should be made much simpler and more direct to
that effect.

Cheers,
Brian
--
https://briansmith.org/

[TLS] The progress about theNegotiated FFDHE prop… Xuelei Fan
Re: [TLS] The progress about theNegotiated FFDHE … Ilari Liusvaara
Re: [TLS] The progress about theNegotiated FFDHE … Sean Turner
Re: [TLS] The progress about theNegotiated FFDHE … Brian Smith