Subject: Re: [TLS] WGLC: draft-ietf-tls-negotiated-ff-dhe-05

From: Daniel Kahn Gillmor <[email-masked]>
Date: Sun, 01 Mar 2015 13:02:22 +0100

On Wed 2015-02-18 13:12:33 +0100, Sean Turner wrote:
> The WGLC has concluded.  dkg noted he’d received some comments
> off-list and Watson provide some input.  We’ll need a new version to
> review the changes to see if it should be progressed or whether
> another WGLC is needed.  I’ve updated the datatracker to reflect the
> new state.
>
> dkg,
>
> Any chance of another version before the 2015-03-09 draft submission deadline?

I've just submitted -06.  The changes from -05 are:

 * re-added 6144, at the request of Niels Ferguson, who wanted a
   smoother ramp-up for people who want to increase adversarial work
   factor.

 * made the recommended minimum exponent size more conservative,
   referencing NIST strength estimates.

 * added a "private use" sub-range within the ffdhe range for
   organizations that want to use their own pre-selected groups.

 * adjusted the false-start guidance slightly.  I agree with Brian Smith
   that this guidance really does belong in the false-start draft
   itself, but given that it is not there yet, i've left it here.  I
   don't think there will be a problem if the false-start draft simply
   repeats the same guidance.

I did not change the "special form" of the groups.

In particular, i left the leading and trailing bits set to 1 for more
efficient reduction, since that is used in practice.  There appear to be
no published attacks against this form (and it is widely used elsewhere,
so it should be an attractive target for research), and the concerns i
heard were that maybe the group strength could be weakened by the number
of bits held constant this way (128 bits, in this case).  For people who
have this concern, i recommend that they select a slightly larger group,
which should more than offset this difference.

   --dkg

---

From: Hubert Kario <[email-masked]>
Date: Mon, 02 Mar 2015 13:11:54 +0100

>    smoother ramp-up for people who want to increase adversarial work

I also see a change from 2048 to 2432 of the smallest group (page 4, line 35), 
but no change in the parameters...

-- 
Regards,
Hubert Kario
Quality Engineer, QE BaseOS Security team
Web: www.cz.redhat.com
Red Hat Czech s.r.o., Purkyňova 99/71, 612 45, Brno, Czech Republic

---

From: Daniel Kahn Gillmor <[email-masked]>
Date: Wed, 04 Mar 2015 00:09:27 +0100

> but no change in the parameters...

Thanks for the review, Hubert (and several others who notified me
off-list about the lingering 2432).  I had initially had 2432 as the
lowest FFDHE parameter, but moved it to 2048 at the request of the WG.
Apparently i missed one 2432 → 2048 change in the line mentioned here.
I've just uploaded -07 to correct the error.

     --dkg