Subject: Re: [TLS] ECDH_anon

From: "Blumenthal, Uri - 0553 - MITLL" <[email-masked]>
Date: Wed, 27 Jan 2016 15:17:55 +0000

IMHO it's not a good idea to re-purpose existing cipher-suites and alter their observed behavior. Likewise for the name overloading. 

Anon  ‎!= Ephemeral, despite some similarities. 

My apologies if I'm missing the point or the frame of a larger issue.

Sent from my BlackBerry 10 smartphone on the Verizon Wireless 4G LTE network.
  Original Message  
From: Nikos Mavrogiannopoulos
Sent: Wednesday, January 27, 2016 03:13
To: Martin Thomson; [email-masked]
Subject: Re: [TLS] ECDH_anon
‎
On Wed, 2016-01-27 at 14:51 +1100, Martin Thomson wrote:
> 4472bis has a TBD regarding a missing "E" in the name of ECDHE_anon
> cipher suites.
> 
> I raised an issue: https://github.com/tlswg/rfc4492bis/issues/17

My understanding of DH_anon and ECDH_anon is that they were made to be
used with static keys so even though anonymous one could verify that he
connected to the same server by checking the server's keys. I don't
believe anyone actually implemented that mode (I'm mostly speculating)
and most of the anon usage is with ephemeral keys, thus this proposal
makes sense.

However if the name is changed to underline the ephemeral part, it
would be nice to document the change of the intended purpose of these
ciphersuites.

regards,
Nikos

_______________________________________________
TLS mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/tls

---

From: Martin Thomson <[email-masked]>
Date: Thu, 28 Jan 2016 04:47:39 +1100

>From a protocol perspective, they are the same.  The distinction at
the protocol level between ECDH_RSA (for example) and ECDH_anon is
that ECDH_anon requires a ServerKeyShare message in the same way that
ECDHE_RSA does.

I agree that Nikos' point is a good one, but we've implementations of
ECDHE_ that provide a stable value for their ephemeral key
(unfortunately, that's the default mode in NSS).

---

From: "Blumenthal, Uri - 0553 - MITLL" <[email-masked]>
Date: Wed, 27 Jan 2016 17:57:47 +0000

On 1/27/16, 12:47 , "Martin Thomson" <[email-masked]> wrote:

>From a protocol perspective, they are the same.

If you mean that you cannot distinguish between the two on the wire - I
agree.

>The distinction at the protocol level between ECDH_RSA (for example) and
>ECDH_anon is

The distinction is in what you can do with the exchange.

>(unfortunately, that's the default mode in NSS).

But that is BAD (and it’s gotta change ;). It’s like implementations that
always generate random number “0” (no smileys - I’ve seen those).

---

From: "Dan Harkins" <[email-masked]>
Date: Sun, 31 Jan 2016 21:56:16 -0800 (PST)

On Wed, January 27, 2016 9:47 am, Martin Thomson wrote:
>> Anon  â€Ž!= Ephemeral, despite some similarities.
>

  So? A static-static, static-ephemeral, and ephemeral-ephemeral
all look the same from a protocol perspective too but they are
very different and have very different properties.

  Dan.

---

From: Martin Thomson <[email-masked]>
Date: Mon, 1 Feb 2016 17:00:52 +1100

> very different and have very different properties.

If a tree falls in the forest and no one deletes the private key, is
it static or ephemeral.