Ciphersuites (was Re: Mandatory to implement cipher suites)

I fail to see why we need both a DHE and ECDHE ciphersuite. I prefer that we have only the ECDHE.

DHE depends on the server sending down secure parameters, which the client has no way to verify. It’s also slower. If we’re not including AES-CBC+HMAC-SHA1 we might as well drop DHE as well. 

Having said that, I would have preferred to not have this requirement at all, and leave it to a TLS standard to have mandatory-to-implement ciphersuites. There is nothing special about HTTP(S) that makes some ciphersuite appropriate here while being less appropriate for SMTP. But if we’ve made up our minds to specify an MTI ciphersuite, I suggest we specify only one, and make that TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256.

Yoav
								
On Jul 17, 2014, at 3:01 AM, Martin Thomson <martin.thomson@gmail.com> wrote:

> In consultation with ekr, I've put together a proposal for addressing
> #498, listing mandatory to implement cipher suites.
> 
> The text is short:
> 
> + Implementations MUST support TLS_DHE_RSA_WITH_AES_128_GCM_SHA256
> + <xref target="TLS12"/> and TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
> + <xref target="TLS-ECDHE"/> with P256 <xref target="FIPS186"/>.
> 
> -- https://github.com/http2/http2-spec/pull/562
> 
> The reason I'm posting is to confirm that adding what is called a
> "downref" is OK with this group.
> 
> A "downref" is a normative reference to a non-standard document, in
> this case, an RFC that is in the Informational category [RFC5289].
> This is allowed in the IETF process, but it requires that the choice
> be made quite explicit.  Read RFC 3967 if you want all the gory
> details.
> 
> Note that the TLS working group is currently debating whether or not
> to put the relevant ECC RFCs on the standards track, which could make
> this question moot.
> 
> If you want to debate the merits of the particular choices, I'd
> request that you start another thread for that purpose.  I only want
> to track the procedural issue here.
>

Received on Thursday, 17 July 2014 18:40:43 UTC