Subject: Re: [Uta] What are the actual best practices in the TLS BCP

From: Peter Gutmann <[email-masked]>
Date: Mon, 23 Jun 2014 09:38:56 +0000

Watson Ladd <[email-masked]> writes:

>Clients don't validate DH parameters, and there is no list to check against,
>which needs to be fixed before we can recommend them.

Given that the standard ECC alternative to DH that everyone uses is NSA-
provided curves [0], I don't think that's much more sensible... the problem
with DH values could be easily solved by using FIPS 186-format parameters
rather than PKCS #3 ones.  Or everyone just uses the IKE DH values (which is
what I do in my code).

Peter.

[0] I know about things like the Brainpool curves, but how many times have you
    seen those used rather than, say, P256?

---

From: Manuel Pégourié-Gonnard <[email-masked]>
Date: Mon, 23 Jun 2014 11:45:47 +0200

On 23/06/2014 11:38, Peter Gutmann wrote:
> provided curves [0], I don't think that's much more sensible...

I disagree. The NSA-provided curves may be weak(er) against some specific
attackers, but bad DH parameters can be used by any malevolent server. Unless
I'm mistaken, there are variants of the triple handshake attack that can use
this fact, but can't work with ECDH.

I'm not saying ECC with the NIST curves is superior to DH, just that given the
current state of DH in TLS, the comparison does not seem obvious: each of them
has its own set of issues.

Manuel.