3 ms·
That ciphersuite has the following problems: - DHE: the way ephemeral DL-DH works in TLS is unfortunately misdesigned. The client first offers DHE-* ciphersui
by ctz 13y ago
That ciphersuite has the following problems:
- DHE: the way ephemeral DL-DH works in TLS is unfortunately misdesigned. The client first offers DHE-* ciphersuites, then the server sends a DL group and public key in that group. The problem arises because now the client cannot:
* reject that group as having too small a modulus to possibly meet the client's security requirements,
* reject that group because it doesn't support one that big (Java SSL stack does this -- doesn't support >1024-bit modulus DH -- and is therefore broken with some more aggressive servers when they select DHE ciphersuites),
* check that the subgroup is of a suitable size to meet the client's security requirements (I'm not sure if SSL predated the Lim Lee paper here, but certainly later SSL standards didn't bother to fix it)
- DSS: fine, but the security-performance profile is similar to RSA, with the exception that verification in DSA is much slower than RSA. That's the reason it's mostly overlooked in favour of RSA.
- AES: as mentioned in the article.
So, yes. It's about as good as other SSL-era ciphersuites; which is to say: slow, badly designed and mostly broken :)
- agwa 13y ago> DSS: fine With the caveat that DSA fails exceptionally catastrophically if the random number generator is bad. If you re-use the same random number for different signatures, an attacker can recover the private key. Given how subtle RNG bugs can be, it's probably imprudent to choose it over RSA.
- tptacek 13y agoThat's true of ECDSA as well, and, in a larger sense, true of RSA --- the "Minding Your P's and Q's" research seemed to boil down to an RNG weakness. It is also, for what it's worth, largely true of all the modern AEAD modes.
- yuhong 13y agoMore importantly, I think DSS requires DSA certificates. The AES-GCM cipher suites in current versions of Windows have the same problem.