Subject: RE: [TLS] Any advice regarding frequency of generating newDHparameters?

From: Peter Williams <[email-masked]>
Date: Mon, 18 Dec 2006 16:59:42 -0800

EDH is superior to RSA> in that CA key compromise does not lead to compromise of any prior> or even future TLS session.
I think this is a dig at RSA's dual reversible function, when a CA cert has both EKUs?
 
IETF's RFC 1422 and RFC 1424 specified CAs with certs that allows RSA to be 
used for key transfer (when sending a CA certain mgt messages) along with issuing 
Certs/CRLs and signed policy messages.
 
Anyways, during SSL3, RFC 1422 was still the authorized standard track spec; pending PKIX 
WG coming up with something to replace it, with a more solid consensus. As Russ
may attest privately, a certain unmentioned company basically sabotaged RFC 1422 over the
whole dual function. The RSA patent in the US, the IETF standards track and Apple's practice 
basically saved RSA's dual reversible function from going under, given tremendous pressure 
(both nice and then much, much nastier in the 1996/7 period). 
 
Use it or not, at your discretion.  Thank others for your having the option, today.
 
Dont assume all RSA knowhow is in the public domain. It took a while for RSA-OAEP to 
get disclosed by IBM, for example.
 
_________________________________________________________________
Use Messenger to talk to your IM friends, even those on Yahoo!
http://ideas.live.com/programpage.aspx?versionId=7adb59de-a857-45ba-81cc-685ee3e858fe

_______________________________________________
TLS mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/tls

---

From: Mike <[email-masked]>
Date: Mon, 18 Dec 2006 17:41:10 -0800

>  EDH is superior to RSA
>  > in that CA key compromise does not lead to compromise of any prior
>  > or even future TLS session.
> 

I'm not dissing RSA, but it is true that if an RSA key is compromised,
the RSA key exchange mechanism allows you to recover the premaster
secret, and thus the entire TLS session of any previous connection.

Mike