Subject: Re: [TLS] Consensus Call for acceptance of

From: Peter Gutmann <[email-masked]>
Date: Wed, 25 Jun 2014 03:03:25 +0000

Watson Ladd <[email-masked]> writes:

>DHE without the extension is insecure.

Why?

(I know the abstract reason, but an unqualified "DHE without the extension is
insecure" is a bit like saying "ECDH is insecure", there is a situation where
it's insecure but it's pretty unlikely).

>Given the performance disadvantages of DHE compared with ECDH, I don't really
>see a benefit to supporting it, given that legacy implementations will not
>support this extension.

Legacy implementations won't support ECDH either, and adding a minor extension
to DH is easier and quicker than adding support for ECC.

Peter.

---

From: Geoffrey Keating <[email-masked]>
Date: 25 Jun 2014 11:04:47 -0700

Peter Gutmann <[email-masked]> writes:

> Legacy implementations won't support ECDH either, and adding a minor
> extension to DH is easier and quicker than adding support for ECC.

I think for most cases, the effort is exactly the same: you have to
upgrade to something later than Windows XP or OpenSSL 0.9.7.  Except
that for ECDH you can upgrade to something that actually exists today
(and has existed for many years) but to implement this new extension
you need to upgrade to something that does not yet exist.

---

From: "Salz, Rich" <[email-masked]>
Date: Wed, 25 Jun 2014 14:20:26 -0400

In our experience, the issue is legacy embedded devices and old Android phones, not XP.  And therefore, I'd be inclined to go with Peter's suggestion.

	/r$

--  
Principal Security Engineer
Akamai Technologies, Cambridge, MA
IM: [email-masked]; Twitter: RichSalz

---

From: Eric Rescorla <[email-masked]>
Date: Wed, 25 Jun 2014 11:23:05 -0700

Speaking as individual I am in favor of adopting this draft.

-Ekr

On Wed, Jun 25, 2014 at 11:20 AM, Salz, Rich <[email-masked]> wrote:

> In our experience, the issue is legacy embedded devices and old Android
> phones, not XP.  And therefore, I'd be inclined to go with Peter's
> suggestion.
>
>         /r$
>
> --
> _______________________________________________
> TLS mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/tls
>

---

From: Geoffrey Keating <[email-masked]>
Date: 25 Jun 2014 13:13:14 -0700

"Salz, Rich" <[email-masked]> writes:

> In our experience, the issue is legacy embedded devices and old
> Android phones, not XP.  And therefore, I'd be inclined to go with
> Peter's suggestion.

For Android, it's the same?  If your device is running some old
Android, like the 2.x versions, chances are this is because it can't
or won't be upgraded, ever, and the solution is to get a new device,
which comes with Android 4.x, which I believe has ECDH.

I don't know about general 'legacy embedded devices', but can you give
an example of one such device which does not support ECDH, will not
support ECDH, but is still being updated and for which the
manufacturer has indicated they might add this extension?  If there
aren't any, I would oppose this RFC as a needless complication to the
SSL protocol.

---

From: [email-masked] (Martin Rex)
Date: Wed, 25 Jun 2014 23:18:14 +0200 (CEST)

> which comes with Android 4.x, which I believe has ECDH.

I think you're underestimating the size of the Android 2.x problem.

There are still plenty of *BRAND NEW* phones sold with Android 2.x today.

The list of this German price search engine currently lists ~190 phones
that are still on sale and equipped with Android 2.x

http://www.heise.de/preisvergleich/?cat=umtsover&xf=148_Android+2#xf_top

and if you want to check for the newest vendor firmware of these phones,
here is where you could look it up for Samsung phones (e.g. Galaxy Y):

http://live.samsung-updates.com/index.php?device=GT-S5360

-Martin

---

From: Geoffrey Keating <[email-masked]>
Date: 25 Jun 2014 14:59:02 -0700

> There are still plenty of *BRAND NEW* phones sold with Android 2.x today.

Do you think that the vendors of these phones will implement the
proposed extension?

---

From: [email-masked] (Martin Rex)
Date: Thu, 26 Jun 2014 00:24:37 +0200 (CEST)

> Do you think that the vendors of these phones will implement the

I don't know.  This is just an example problem.
There are _hundreds_ of independent TLS implementations out there on
the internet, and the fact that ECDH exists in newer versions of
some OpenSource implementations doesn't mean that everyone can or will
just use that instead of what he is currently using (there are many
reasons not to).

Code size and complexity of a change is often a deciding factor whether
a software update is (a) possible at all and (b) might get produced by
the vendor.

Looking at the capabilities of a product like this:
http://www.oracle.com/us/products/servers-storage/036080.pdf

a DH-improving firmware update seems possible,
but moving to ECDH looks more like impossible.

-Martin