Subject: Re: [TLS] ECDH_anon

From: Bodo Moeller <[email-masked]>
Date: Mon, 1 Feb 2016 09:30:13 +0100

If you keep using the same [EC]DH keys indefinitely, you're merely
pseudonymous, not anonymous :-)

Without a naming precedent, I'd still prefer [EC]DHE_anon over [EC]DH_anon
(and possibly "unauth" over "anon", because "anon" could be interpreted as
overpromising), but given the existing naming pattern started by DH_anon, I
prefer consistency with that one.

Bodo

---

From: "Dan Harkins" <[email-masked]>
Date: Mon, 1 Feb 2016 08:48:23 -0800 (PST)

On Sun, January 31, 2016 10:00 pm, Martin Thomson wrote:
> On 1 February 2016 at 16:56, Dan Harkins <[email-masked]> wrote:
>>>>From a protocol perspective, they are the same.  The distinction at
>>> the protocol level between ECDH_RSA (for example) and ECDH_anon is
>>> that ECDH_anon requires a ServerKeyShare message in the same way that
>>> ECDHE_RSA does.
>>
>>   So? A static-static, static-ephemeral, and ephemeral-ephemeral
>> all look the same from a protocol perspective too but they are
>> very different and have very different properties.
>
> If a tree falls in the forest and no one deletes the private key, is
> it static or ephemeral.

  If you never use it again then its compromise would only expose
that 1 exchange so I'd say it's ephemeral. If you reuse it then it
becomes static.

  But if this problem is because we have code that is not deleting
the private keys for the ECDH_anon exchange then I'd say the pull
request should be with that codebase to fix that problem.

  Dan.