Subject: [TLS] How does a TLS server indicates which EC curves it supports for client side auth ?

From: Fabrice Gautier <[email-masked]>
Date: Mon, 14 Nov 2011 15:55:54 -0800

Hi,

A TLS client specifies which curves and point formats it supports in a
ClientHello extension. For the ServerHello, RFC 4492 only specifies
the point format extension. No supported curves is returned as part of
the ServerHello.

When it comes to client side cert with ECDSA, TLS 1.2 RFC 5246,
section 7.4.6 (Client Certificate) reads:

ecdsa_sign         ECDSA-capable public key; the certificate MUST
                          allow the key to be used for signing with the
                          hash algorithm that will be employed in the
                          certificate verify message; the public key
                          MUST use a curve and point format supported by
                          the server.

I've an issue with the last bit: "the public key MUST use a curve and
point format supported by the server."

At that point, how does the client know what curves are supported by
the server ?

In TLS 1.2, the CertificateRequest message specify which Signature and
Hash algorithm are supported by the server, but I can't find such
information for Curves parameters.

Thanks

-- Fabrice

---

From: Peter Gutmann <[email-masked]>
Date: Tue, 15 Nov 2011 14:23:03 +1300

Fabrice Gautier <[email-masked]> writes:

>At that point, how does the client know what curves are supported by the
>server ?

It's quite a mess.  See:

http://tools.ietf.org/html/draft-gutmann-tls-eccsuites-01

for a longer discussion of these issues, and a solution.  I'm just waiting for
the IETF blackout period to end to re-post the draft.

And having said that, since it's been out for six months and there have been
no major objections to it, it's probably time to move it towards RFC status so
that people can actually make use of it.

Peter.

---

From: Yoav Nir <[email-masked]>
Date: Tue, 15 Nov 2011 03:50:37 +0200

> that people can actually make use of it.

Blackout period is over as of yesterday.

I think there will be some objections, because what you are proposing can already be done with existing ciphersuites (although with the "chinese menu" for ECC curves)

---

From: Nikos Mavrogiannopoulos <[email-masked]>
Date: Tue, 15 Nov 2011 08:46:45 +0100

> At that point, how does the client know what curves are supported by

It does not. RFC5480 however, recommends for interoperability few curves
in the security considerations section. Those seem to be the curves used
by most implementations.

I've taken an alternative approach to Peter and documented those as
recommended for TLS as well.
http://tools.ietf.org/html/draft-mavrogiannopoulos-tls-dss-01

regards,
Nikos