Subject: [Uta] Remarks on bcp-tls-sheffer-01

From: Watson Ladd <[email-masked]>
Date: Tue, 31 Dec 2013 09:57:34 -0500

This draft has some issues.
First, its main recommendation involves adoption of TLS 1.2. For servers and
clients that cannot do this we have a problem, but I don't think the
draft should be
silent on this issue. It should strongly urge adoption and explain why TLS 1.0
doesn't work out. 22.5% percent of websites use TLS 1.2 according to sslpulse.

Secondly, it recommends brainpool over P256. Yes, there is a question about P256
parameters, but brainpool constant time implementations are not known to exist.

Section 6.2 is factually incorrect: DDH is not equivalent to the DLP.
(I could insert
a long story about weak reductions here, but they don't matter for
practical use)

Thirdly, I don't quite get the RSA over ECDSA recommendation. Some
implementations (IE on a windows version I don't recall) only support
ECDHE in the Suite B configuration, with all certificates ECDSA. Is
this because of legacy certificates?

Fourth, if a browser doesn't support TLS 1.2 and ECDSA there will be a
fallback. What should that fallback be, and how should various
fallbacks be ordered?

Sincerely,
Watson Ladd