Subject: Re: [TLS] Missing cipher: anon ephemeral ECDH w/ SHA-2 nor AEAD modes

From: Peter Gutmann <[email-masked]>
Date: Thu, 21 Mar 2013 04:53:56 +0000

Martin Rex <[email-masked]> writes:

>Our TLS implementation does not contain anonymous cipher suites, and I
>stronly doubt that anyone could provide a convincing rationale to change
>that.

Just a small technical nit here, if your implementation provides a means of
clicking past certificate mismatches then it provides effective anon-DH even
if it's not directly implemented as such.  A lot of deployment of bulk-traffic
TLS (e.g. for STMP via STARTTLS, and many VPNs) is also effective anon-DH.
Since it uses RSA for this, it's effective anon-DH without any of its
advantages.

Peter.

---

From: Peter Gutmann <[email-masked]>
Date: Mon, 25 Mar 2013 04:52:02 +0000

Nikos Mavrogiannopoulos <[email-masked]> writes:

>Indeed, but as a comment I'd say that the anon ciphersuites have a big
>disadvantage comparing to using the certificate based ones for anonymous
>authentication, and that is they cannot support key continuity.

This is a good point, but then they can support key continuity, you just mix
in secret info from session n-1 into the premaster secret for session n.  It's
even simpler than using certs.

Peter.