Subject: [TLS] what's Negotiated Groups extension for?

From: "Bingzheng Wu" <[email-masked]>
Date: Fri, 13 Nov 2015 16:12:45 +0800

Hi All,

Without the Negotiated Groups extension,

Case 1: if the server accepts the Groups in ClientHello.keyshare, it just use one of the Groups for DH, and CertificateVerify for both sides.

Case 2: else it responses an HelloRetryRequest message, which takes *all Groups* that the server supports. Client picks one and continue.

I think Case 1 always happens in real world, and Negotiated Groups extension is then useless.
So removing it will simplify the protocol and save some bytes, without bring any disadvantage.

Do I miss anything? Does this extension exist for compatible with elliptic_curves?

Wu

---

From: Eric Rescorla <[email-masked]>
Date: Fri, 13 Nov 2015 06:38:03 -0800

On Fri, Nov 13, 2015 at 12:12 AM, Bingzheng Wu <
[email-masked]> wrote:

> Case 1: if the server accepts the Groups in ClientHello.keyshare, it just
> use one of the Groups for DH, and CertificateVerify for both sides.
>
> Case 2: else it responses an HelloRetryRequest message, which takes *all
> Groups* that the server supports. Client picks one and continue.
>

No. In case 2, the client indicates the groups it supports and the server
tells it which group to use.

-Ekr

> _______________________________________________
> TLS mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/tls
>

---

From: "Bingzheng Wu" <[email-masked]>
Date: Sun, 15 Nov 2015 16:28:20 +0800

> tells it which group to use.

So, could the HelloRetryRequest be changed to indicate *all Groups* ?
If so, could the Negotiated Groups extension be removed?

---

From: Eric Rescorla <[email-masked]>
Date: Sun, 15 Nov 2015 07:00:53 -0800

On Sun, Nov 15, 2015 at 12:28 AM, Bingzheng Wu <
[email-masked]> wrote:

> >> Case 1: if the server accepts the Groups in ClientHello.keyshare, it
> just use one of the Groups for DH, and CertificateVerify for both sides.
> >>
> >> Case 2: else it responses an HelloRetryRequest message, which takes
> *all Groups* that the server supports. Client picks one and continue.
>
>

No, I don't think that would be a good idea.

> If so, could the Negotiated Groups extension be removed?

No.

-Ekr