Subject: [TLS] Does anyone still want dh_rsa and dh_dss?

From: Eric Rescorla <[email-masked]>
Date: Thu, 26 Jun 2014 09:14:15 -0700

We've already removed static RSA for TLS 1.3 but we didn't
emove dh_rsa and dh_dss (as opposed to dhe_rsa and
dhe_dss). It seems like the arguments for removing static
RSA apply even more strongly here.

Is there any reason to retain these in TLS 1.3?

-Ekr

---

From: Yoav Nir <[email-masked]>
Date: Thu, 26 Jun 2014 20:25:10 +0300

> Is there any reason to retain these in TLS 1.3?

None that I can see

---

From: Adam Langley <[email-masked]>
Date: Thu, 26 Jun 2014 10:32:18 -0700

> Is there any reason to retain these in TLS 1.3?

I don't believe so. (Additionally, I would drop DSS completely.)

Cheers

AGL

-- 
Adam Langley [email-masked] https://www.imperialviolet.org

---

From: Dan Brown <[email-masked]>
Date: Thu, 26 Jun 2014 17:54:01 +0000

>From: TLS [mailto:[email-masked]] On Behalf Of Eric Rescorla
>
> It seems like the arguments for removing static

I agree in that client auth + static DH is weaker than client auth + static 
RSA, because the former is vulnerable to key-compromise impersonation (KCI). I 
mentioned KCI a while back on this list, but forgot to add that it depends on 
client auth.

---

From: Michael StJohns <[email-masked]>
Date: Sun, 29 Jun 2014 16:45:25 -0400

> Is there any reason to retain these in TLS 1.3?

Would it be more appropriate to ask this in  a more crypto-neutral 
manner?    E.g. We've removed Public Key Transport as a valid mechanism 
for pre-master setup.  So instead maybe ask this as "Should we remove 
all non-ephemeral key agreement mechanisms?"

Or is there some reason to retain non-ephemeral ECDH vice non-ephemeral DH?

Mike

>
> -Ekr
>
>
>
> _______________________________________________
> TLS mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/tls

---

From: Eric Rescorla <[email-masked]>
Date: Sun, 29 Jun 2014 13:54:17 -0700

On Sun, Jun 29, 2014 at 1:45 PM, Michael StJohns <[email-masked]>
wrote:

> manner?    E.g. We've removed Public Key Transport as a valid mechanism for
> pre-master setup.  So instead maybe ask this as "Should we remove all
> non-ephemeral key agreement mechanisms?"
>

Not that I know of, it's just that I was working through the TLS spec and
the ECDHE code points don't appear there, so I didn't think  of it.

-Ekr

Mike
> TLS mailing [email-masked]://www.ietf.org/mailman/listinfo/tls
>
>
>

---

From: Watson Ladd <[email-masked]>
Date: Sun, 29 Jun 2014 13:55:07 -0700

On Sun, Jun 29, 2014 at 1:45 PM, Michael StJohns <[email-masked]> wrote:
> Would it be more appropriate to ask this in  a more crypto-neutral manner?
> E.g. We've removed Public Key Transport as a valid mechanism for pre-master
> setup.  So instead maybe ask this as "Should we remove all non-ephemeral key
> agreement mechanisms?"
>

Yes, there is potentially.

With DH on genus 0 we need to restrict parameter choices. Existing
certificates probably don't fit into that framework, so won't work.

However, I do think we should chuck both out because they are not
forward secure.
Sincerely,
Watson Ladd

-- 
"Those who would give up Essential Liberty to purchase a little
Temporary Safety deserve neither  Liberty nor Safety."
-- Benjamin Franklin

---

From: Bodo Moeller <[email-masked]>
Date: Mon, 30 Jun 2014 10:54:07 +0200

> [...] is there some reason to retain non-ephemeral ECDH vice non-ephemeral
>> DH?
>>
>

> the ECDHE code points don't appear there, so I didn't think  of it.

I agree to throwing out all of these.

(From a practical point of view, there probably are more ECC certificates
that *could*, in theory, be used for static ECDH than there are DH
certificates, but I don't see a good reason to support that in the
protocol. As I see it, non-ephemeral ECDH was essentially for "feature
parity" with non-ephemeral DH.)

Bodo

---

From: Steve Checkoway <[email-masked]>
Date: Mon, 30 Jun 2014 09:40:59 -0400

> I don't believe so. (Additionally, I would drop DSS completely.)

+1

-- 
Steve Checkoway

---

From: Juho Vähä-Herttua <[email-masked]>
Date: Mon, 30 Jun 2014 16:53:36 +0300

On 30.6.2014, at 11.54, Bodo Moeller <[email-masked]> wrote:

>>> [...] is there some reason to retain non-ephemeral ECDH vice     non-ephemeral DH?
>  

+1

Juho