Subject: [TLS] key sizes in TLS.

From: "Dang, Quynh" <[email-masked]>
Date: Mon, 10 Jun 2013 10:08:37 -0400

Currently (as I understand it), client has no mechanism (or extension) to let the server know what DH-sizes are acceptable (for security reason) when doing DH-RSA and DH-DSS key exchanges and what RSA and DSS key sizes are acceptable for server authentication.

Also, there is no extension or mechanism for which the server can tell the client which key sizes it will accept for client's authentication (in a certificate request the server can tell the client which algorithm(s) it would accept for the client's authentication, but not key sizes).

If I understand it correctly, the client just generates DH parameters comparable with the DH parameters, which the client receives from the server. (I suppose the client could terminate the connection using its local policy when the DH parameters don't meet its security strength requirement). So, I guess it would be nice if the client could let the server know what key size(s) will be acceptable to the client.

I don’t know if it would make sense to specify (1) a method for which the client can use to let the server know what key size(s) (DSS or RSA and DH) are acceptable and (2) a method for which the server can let the client know what key size(s) is/are acceptable to the server for the client's authentication.

Even with some (or proposed) ECC-based cipher suites, there is similar issue about key sizes for client’s authentication.

I would appreciate if you share what you think about the issues.

Regards,
Quynh.

---

From: Nikos Mavrogiannopoulos <[email-masked]>
Date: Tue, 11 Jun 2013 12:12:06 +0200

On Mon, Jun 10, 2013 at 4:08 PM, Dang, Quynh <[email-masked]> wrote:

> I don’t know if it would make sense to specify (1) a method for which the
> client can use to let the server know what key size(s) (DSS or RSA and DH)
> are acceptable and (2) a method for which the server can let the client know
> what key size(s) is/are acceptable to the server for the client's
> authentication.

You are correct. That is an omission from the DHE key exchange in TLS.
At least in gnutls it caused several connection failure issues once we
required a DH group of more than 768 bits in the client.

Overall my impression is that the DHE-based ciphersuites are pretty
much neglected. There are also optimizations that could be done (e.g.,
the server specifying the size of the generator's subgroup), but
no-one ever bothered to update the protocol.

> Even with some (or proposed) ECC-based cipher suites, there is similar issue
> about key sizes for client’s authentication.

Which ones do  you mean? The ECC-based ciphersuites (with named
curves) have the size of the curve hard-coded so I have noticed no
such issues there. In that aspect they are better than their DH
counterparts. If you mean the ECC ciphersuites with explicit curves I
think you should reconsider their usage [0].

regards,
Nikos

[0]. https://www.cosic.esat.kuleuven.be/publications/private/article-2216.pdf

---

From: Nikos Mavrogiannopoulos <[email-masked]>
Date: Tue, 11 Jun 2013 12:15:56 +0200

> [0]. https://www.cosic.esat.kuleuven.be/publications/private/article-2216.pdf

Sorry, the correct URL is:
https://www.cosic.esat.kuleuven.be/publications/article-2216.pdf

regards,
Nikos

---

From: "Dang, Quynh" <[email-masked]>
Date: Tue, 11 Jun 2013 11:17:16 -0400

For example, proposed ciphersuites in
http://tools.ietf.org/html/draft-mcgrew-tls-aes-ccm-ecc-06, it has
requirements for client certificate, see the paragraph below.

"The server's certificate MUST contain an ECDSA-capable public key,
      it MUST be signed with ECDSA, and it MUST use SHA-256, SHA-384, or
      SHA-512.  The Signature Algorithms extension (Section 7.4.1.4.1 of
      [RFC5246] <http://tools.ietf.org/html/rfc5246#section-7.4.1.4.1>)
MUST be used to indicate support of those signature and
      hash algorithms.  If a client certificate is used, the same
      conditions apply to it.  The acceptable choices of hashes and
      curves that can be used with each ciphersuite are detailed in
      Section 2.2".

However, in many other ciphersuites' specifications, there is no
requirement about what key size(s) (curve(s)) (in ECDSA) to sign the
client certificate.

Regards,
Quynh. 

On 6/11/13 6:12 AM, "Nikos Mavrogiannopoulos" <[email-masked]> wrote:

>> I don¹t know if it would make sense to specify (1) a method for which
>>the
>> about key sizes for client¹s authentication.
>
>[0]. 
>https://www.cosic.esat.kuleuven.be/publications/private/article-2216.pdf

---

From: Nikos Mavrogiannopoulos <[email-masked]>
Date: Thu, 13 Jun 2013 13:54:29 +0200

>       curves that can be used with each ciphersuite are detailed in

Indeed that looks like an issue of these particular ciphersuites.

regards,
Nikos