Subject: RE: [TLS] Any advice regarding frequency of generating

From: Peter Williams <[email-masked]>
Date: Tue, 19 Dec 2006 09:46:51 -0800

Martin:
 
RSA ephemeral is not "prohibited".  Is not standardized, thats true.
 
Look at it now from various angles. With Russ's non-repudiation proposal, a TLS session 
can be a form of signature, "certifying" (ephemeral) public keys. Another session, would now 
use the NR-grade (ephemeral) RSA key... so recently learned.
 
Think about using TCP pipelining,  where multiple client protocols are always 
in play at the same time, not all of which are standards defined; some may be 
application defined. Break the limiting mental model of: create bind, make session, 
use session, drop TLS connection, keepalive TCP, resume session.
 
> The same would be achievable with RSA ephemeral keys.> I wonder why ephemeral RSA keys are prohibited for regular> RSA key exchange algorithms. Ephemeral RSA keypairs with the same> size as the server's cert would provide perfect forward secrecy> and protection against passive attacks -- and the entire code> necessary to implement this is already there.> > -Martin> > > _______________________________________________> TLS mailing list> [email-masked]> https://www1.ietf.org/mailman/listinfo/tls
_________________________________________________________________
Express yourself with gadgets on Windows Live Spaces
http://discoverspaces.live.com?source=hmtag1&loc=us

_______________________________________________
TLS mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/tls

---

From: Mike <[email-masked]>
Date: Tue, 19 Dec 2006 10:09:53 -0800

> RSA ephemeral is not "prohibited".  Is not standardized, thats true.

It would be easy to define a hello extension to add ephemeral RSA.
The client would send the extension indicating that it would accept
an ephemeral RSA key, and the server would respond with the same
extension in the server hello indicating that it will send a server
key exchange message with the key.  This would avoid the need to
define new cipher suites for ephemeral RSA.

Mike

---

From: Martin Rex <[email-masked]>
Date: Tue, 19 Dec 2006 21:04:45 +0100 (MET)

> RSA ephemeral is not "prohibited".  Is not standardized, thats true.

They are standardized and required for SSL ciphersuites with the
RSA_EXPORT key exchange method when a Server cert with an
RSA key >512 bit is being used.

quoting rfc2246 (tls v1.0) 7.4.3.  Server key exchange message:

   When this message will be sent:
       This message will be sent immediately after the server
       certificate message (or the server hello message, if this is an
       anonymous negotiation).

       The server key exchange message is sent by the server only when
       the server certificate message (if sent) does not contain enough
       data to allow the client to exchange a premaster secret. This is
       true for the following key exchange methods:

           RSA_EXPORT (if the public key in the server certificate is
           longer than 512 bits)
           DHE_DSS
           DHE_DSS_EXPORT
           DHE_RSA
           DHE_RSA_EXPORT
           DH_anon

       It is not legal to send the server key exchange message for the
       following key exchange methods:

           RSA
           RSA_EXPORT (when the public key in the server certificate is
           less than or equal to 512 bits in length)
           DH_DSS
           DH_RSA

rfc2246 says "It is not legal" to use ephemeral RSA for ciphersuites
with the RSA key exchange method.  And while the first part at least
mentions the possibility of sign-only RSA keys, the second part
completely ignores them.

What is that supposed to mean anyway?  "Not legal (under some jurisdictions?)
but well within the spec" or "MUST NOT send/use" in spec language?

>
> With Russ's non-repudiation proposal, a TLS session can be a form of
> signature.

Btw. I completely and thoroughly dislike Russ' proposal for non-repudiation
(he used the disguise terminology "evidence" though), both from a
technical standpoint, as well as from a "political" perspective.

-Martin