Subject: [ietf-tls] draft-ietf-tls-ciphersuite-01a.txt suggestion

From: Tom Wu <[email-masked]>
Date: Thu, 02 Nov 2000 20:59:54 -0800

Pete Chown wrote:
>
> The main change in this revision is that the document now provides AES
> analogues for most of the original ciphersuites, including static RSA.
> The exceptions are the "anon" and export ciphersuites.  The first
> group have been deprecated ever since the original TLS specification,
> while recent legal changes have made the second group essentially
> irrelevant.

I would like to have the anonymous ciphersuite(s) added back to the AES
ciphersuite I-D.  I've taken a look at the original TLS specification
regarding ADH, which states:

> Warning: Completely anonymous connections only provide protection
>           against passive eavesdropping. Unless an independent tamper-
>           proof channel is used to verify that the finished messages
>           were not replaced by an attacker, server authentication is
>           required in environments where active man-in-the-middle
>           attacks are a concern.

Since the draft was published, newer applications have been developed
that use anonymous key exchange and which validate the TLS Finished
messages to prevent man-in-the-middle attacks and establish mutual
authentication.  The TLS-based Telnet security draft
(draft-ietf-tn3270e-telnet-tls-05.txt) being developed by the tn3270e WG
gives guidelines on how exactly to verify Finished messages, and it
allows TLS to be used in situations where certificates are not being
used, such as with strong password authentication techniques.

Since SSL libraries like OpenSSL provide explicit hooks for verifying
TLS Finished messages, "authenticated" anonymous TLS sessions fill a
very useful need for transport security, and for technical reasons seem
to be a very good fit for authentication methods that don't fit the PKI
mold.  As long as the Finished messages are verified securely, ADH
should also offer forward secrecy for the TLS session.  The same reasons
for advocating AES over 3DES ciphersuites apply to ADH-AES as well.
-- 
Tom Wu
Principal Software Engineer
Arcot Systems
(408) 969-6124
"The Borg?  Sounds Swedish..."

---
You are currently subscribed to ietf-tls as: [email-masked]
To unsubscribe send a blank email to [email-masked]

---

From: Dr S N Henson <[email-masked]>
Date: Fri, 03 Nov 2000 13:14:12 +0000

> regarding ADH, which states:

Yes I agree. I know of several people using anon DH with alternative
authentication schemes. 

Andreas Sterbenz wrote:
> 
> It is ok for me as it is, I just do not think there is much use in
> defining new static Diffie-Hellman ciphersuites (DH_RSA, DH_DSS) given
> the history of the existing ones (the only implementation that I know
> supports them is our Java SSL/TLS library).
> 
> Now that the RSA patent expired there seems to be even less interest in
> DH certificates.
> 

I also don't know of anyone using static DH ciphersuites but they may
have a use. If used with short exponent DH they have the lowest server
overhead of all the ciphersuites.

In the older static DH ciphersuites I believe PKCS#3 DH certificates
were used. Perhaps we could add the additional requirement that X9.42 DH
certificates must be used.

The main problem for public servers is getting a public CA to sign a DH
certificate request.

Steve.
-- 
Dr Stephen N. Henson.   http://www.drh-consultancy.demon.co.uk/
Personal Email: [email-masked] 
Senior crypto engineer, Celo Communications: http://www.celocom.com/
Core developer of the   OpenSSL project: http://www.openssl.org/
Business Email: [email-masked] PGP key: via homepage.

---