Subject: [TLS] Adoption call for Deprecating FFDH(E) Ciphersuites in TLS

From: Joseph Salowey <[email-masked]>
Date: Thu, 29 Jul 2021 14:50:24 -0700

This is a working group call for adoption for Deprecating FFDH(E)
Ciphersuites in TLS (draft-bartle-tls-deprecate-ffdhe-00
<https://datatracker.ietf.org/doc/draft-bartle-tls-deprecate-ffdhe/>). We
had a presentation for this draft at the IETF 110 meeting and since it is
a similar topic to the key exchange deprecation draft the chairs want to
get a sense if the working group wants to adopt this draft (perhaps the
drafts could be merged if both move forward).  Please review the draft and
post your comments to the list by Friday, August 13, 2021.

Thanks,

The TLS chairs

---

From: "Salz, Rich" <[email-masked]>
Date: Thu, 29 Jul 2021 22:08:35 +0000

*   This is a working group call for adoption for Deprecating FFDH(E) Ciphersuites in TLS (draft-bartle-tls-deprecate-ffdhe-00<https://urldefense.com/v3/__https:/datatracker.ietf.org/doc/draft-bartle-tls-deprecate-ffdhe/__;!!GjvTz_vk!FlMZCO0a7tFKUtFIzYQuaGPHZKDkHN8YLu7ao9lNmCL1UYhg9sfLscTcrh8Z$>).

I support this draft as well, and the idea of merging them sounds good right now.

---

From: "Martin Thomson" <[email-masked]>
Date: Fri, 30 Jul 2021 10:41:05 +1000

I support the *contents* of this document.  The title, however, I can't agree to.  So I want to be clear about the scope of the work, namely deprecating semi-static FFDH and ECDH suites and any use of FFDHE ephemeral suites with reused keys.

The draft limits the ban on ephemeral key reuse to FFDHE, which is right; I could tolerate a prohibition on reuse for ECDH, but I know that we rely on that for HPKE and other things, so it can't really be bad enough to ban.

Cheers,
Martin

On Fri, Jul 30, 2021, at 07:50, Joseph Salowey wrote:
> <https://datatracker.ietf.org/doc/draft-bartle-tls-deprecate-ffdhe/>). 
> We had a presentation for this draft at the IETF 110 meeting and since 
> it is a similar topic to the key exchange deprecation draft the chairs 
> want to get a sense if the working group wants to adopt this draft 
> (perhaps the drafts could be merged if both move forward).  Please 
> review the draft and post your comments to the list by Friday, August 
> 13, 2021.  
> 
> Thanks,
> 
> The TLS chairs
> _______________________________________________
> TLS mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/tls
>

---

From: Carrick Bartle <[email-masked]>
Date: Fri, 30 Jul 2021 11:56:07 -0700

Sorry, the title will be changed in the next version, which I'll be posting as soon as possible. You are correct about the scope of the work.

> On Jul 29, 2021, at 5:41 PM, Martin Thomson <[email-masked]> wrote:
> 
>> <https://datatracker.ietf.org/doc/draft-bartle-tls-deprecate-ffdhe/ <https://datatracker.ietf.org/doc/draft-bartle-tls-deprecate-ffdhe/>>). 
> [email-masked] <mailto:[email-masked]>
> https://www.ietf.org/mailman/listinfo/tls <https://www.ietf.org/mailman/listinfo/tls>

---

From: Carrick Bartle <[email-masked]>
Date: Fri, 30 Jul 2021 13:25:10 -0700

Hi Martin,

Actually, a clarification question (more relevant to the other thread <https://mailarchive.ietf.org/arch/browse/tls/?q=Adoption%20call%20for%20Deprecating%20Obsolete%20Key%20Exchange%20Methods%20in%20TLS> : are you opposed to fully deprecating FFDHE? If so, why?

---

From: "Martin Thomson" <[email-masked]>
Date: Sat, 31 Jul 2021 11:51:23 +1000

On Sat, Jul 31, 2021, at 06:25, Carrick Bartle wrote:
>  are you opposed to fully deprecating FFDHE? If so, why?

No so much opposed as that it is not necessary.  Though the TLS 1.2 variant is - as others have noted - close to impossible to negotiate the "good" groups, it's not concretely bad when you use it in TLS 1.3.