Subject: Re: [TLS] DH group validation

From: Russ Housley <[email-masked]>
Date: Tue, 23 Oct 2007 09:02:34 -0400

Eric:

 > In the TLS 1.2 standard ciphersuites, a signature authenticates that
 > the server really has chosen this particular group.  (Or, in anonymous
 > ciphersuites, even *with* group verification you can't really trust
 > the DH value if you suspect there might be an active adversary.)  You
 > can't verify *all* security-relevant aspects of server behavior, so
 > why spend time verifying this particular one?  If the server
 > implementation sucks, it could use a perfectly nice DH group in a
 > perfectly broken way -- such as by using a low-entropy secret
 > exponent.  I don't see that verifying the DH group doesn't really add
 > significant value: it does not counter any threats by actual
 > adversaries.

Makes sense to me.

 > Looking at the (purported) group size is reasonable because it is
 > cheap to do, so that the client can detect if the server at least
 > pretends to use a certain security level.

The check is simple and straightforward, but how do you know how big 
it ought to be?  Is this local configuration?

Russ

_______________________________________________
TLS mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/tls

---

From: Bodo Moeller <[email-masked]>
Date: Mon, 29 Oct 2007 17:50:16 +0100

> it ought to be?  Is this local configuration?

Yes; like insisting on certain symmetric key sizes.  (If you insist
on having at least 100 bits of symmetric encryption security, then
you need a group order of at least 200 bits.)

Bodo