Subject: [TLS] 4492 ECDH_anon

From: Martin Thomson <[email-masked]>
Date: Wed, 22 Jul 2015 01:44:59 -0700

I have never understood why 4492 doesn't claim forward secrecy for
ECDH_anon suites.  Can someone explain why this doesn't have an 'E'?

---

From: Yoav Nir <[email-masked]>
Date: Wed, 22 Jul 2015 11:20:46 +0200

On Jul 22, 2015, at 10:44 AM, Martin Thomson <[email-masked]> wrote:

> ECDH_anon suites.  Can someone explain why this doesn't have an 'E’?

I wasn’t there for the original 4492, but I think it’s because the old anonymous ciphersuites were called DH_anon (no E). 

They both provide forward secrecy.

Yoav

---

From: Martin Thomson <[email-masked]>
Date: Wed, 22 Jul 2015 02:23:28 -0700

> They both provide forward secrecy.

The draft specifically excludes ECDH_anon from the following
statement, implying otherwise:

   The ECDHE_ECDSA and ECDHE_RSA key exchange mechanisms provide forward
   secrecy.

It might be a good idea to revise that.

---

From: Yoav Nir <[email-masked]>
Date: Wed, 22 Jul 2015 11:29:43 +0200

PR at https://github.com/tlswg/rfc4492bis/blob/master/draft-ietf-tls-rfc4492bis.xml ?

> On Jul 22, 2015, at 11:23 AM, Martin Thomson <[email-masked]> wrote:
>

---

From: Benjamin Beurdouche <[email-masked]>
Date: Wed, 22 Jul 2015 11:30:21 +0200

> They both provide forward secrecy.

This is very confusing …

---

From: Martin Thomson <[email-masked]>
Date: Wed, 22 Jul 2015 04:36:50 -0700

> PR at https://github.com/tlswg/rfc4492bis/blob/master/draft-ietf-tls-rfc4492bis.xml ?

https://github.com/tlswg/rfc4492bis/pull/6

---

From: Dave Garrett <[email-masked]>
Date: Wed, 22 Jul 2015 13:07:09 -0400

> https://github.com/tlswg/rfc4492bis/pull/6

Could the cipher suite names be officially changed to add the 'E' to them? It'd make things simpler to be consistent.

e.g.

TLS_ECDH_anon_WITH_AES_128_CBC_SHA => TLS_ECDHE_anon_WITH_AES_128_CBC_SHA

Anon is ephemeral by nature, but putting the 'E' in there matches existing notation better. TLS 1.3 will be deprecating all ECDH in favor of ECDHE, so it would be nice to not have to always stick in side notes that ECDH_anon==ECDHE_anon.

Dave

---

From: Martin Thomson <[email-masked]>
Date: Wed, 22 Jul 2015 19:09:11 +0200

> Could the cipher suite names be officially changed to add the 'E' to them? It'd make things simpler to be consistent.

I'd be OK with that.  I didn't do it in the PR, but would be happy to
make a new one.

---

From: Yoav Nir <[email-masked]>
Date: Wed, 22 Jul 2015 19:12:45 +0200

I’d like to hear from the chairs if it’s OK to rename stuff in the IANA registry.

That has some implications for implementations that use these names.

Not to mention that the same issue applies to DH(E)_anon

> On Jul 22, 2015, at 7:09 PM, Martin Thomson <[email-masked]> wrote:
>

---

From: Martin Thomson <[email-masked]>
Date: Wed, 22 Jul 2015 19:20:52 +0200

> Not to mention that the same issue applies to DH(E)_anon

I believe that renaming entries in the IANA registry is possible.  I
don't think that it affects implementations, though it might cause
some minor usability issues if people attempt to configure them using
the IANA names.

---

From: Dave Garrett <[email-masked]>
Date: Wed, 22 Jul 2015 13:25:08 -0400

On Wednesday, July 22, 2015 01:20:52 pm Martin Thomson wrote:
> I believe that renaming entries in the IANA registry is possible.

Negotiated FFDHE is renaming an extension identifier in the IANA registry, so this is not an entirely new issue.
https://datatracker.ietf.org/doc/draft-ietf-tls-negotiated-ff-dhe/
https://www.iana.org/assignments/tls-extensiontype-values/tls-extensiontype-values.xhtml

Dave

---

From: "Salz, Rich" <[email-masked]>
Date: Wed, 22 Jul 2015 18:35:17 +0000

> I'd be OK with that.  I didn't do it in the PR, but would be happy to make a
> new one.

Please do.

---

From: Yoav Nir <[email-masked]>
Date: Tue, 28 Jul 2015 08:51:29 +0300

> On Jul 22, 2015, at 2:36 PM, Martin Thomson <[email-masked]> wrote:
> 

So the change seems fine to me. Unless anyone objects by Friday the 31st, I will merge this.

If you object, please speak now.

Thanks

Yoav