Subject: Re: [rtcweb] draft-ietf-rtcweb-security-arch and crypto agility

From: Eric Rescorla <[email-masked]>
Date: Thu, 1 Sep 2016 08:58:51 -0700

On Wed, Aug 31, 2016 at 3:52 PM, Cullen Jennings <[email-masked]> wrote:

>
> > On Aug 31, 2016, at 2:15 PM, Eric Rescorla <[email-masked]> wrote:
> >
> > On Wed, Aug 31, 2016 at 10:51 AM, Cullen Jennings <[email-masked]> wrote:
> > The security arch only requires one cipher TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
> with the the P-256 curve. Only having one seems like a bad idea of a crypto
> agility point of view. Lets say it turns out there is a problem with that
> curve or with EC in general, deployments will not have anything they can
> switch to.
> >
> > Having just one MTI cipher suite is pretty much SOP (this is what TLS
> 1.2 does, for instance).
> > I wouldn't be opposed to requiring another group, presumably either
> X25519 or FFDH2048.
> > (Yes, I am aware that these are at opposite ends of the spectrum).
> >
> >
> > I'd like to keep one of the RSA based ciphers as also MTI.
> >
> > The RSA ciphers do not provide PFS, so I do not think this is a good plan
> >
>
> I was assuming some sort of DH combined with RSA. I do know we want to
> stick with PFS schemes.
>

OK, so in that case it seems like you want

TLS_DHE_RSA_WITH_AES_128_CBC_SHA

With that said, I think the ship has already sailed on this. Chrome is
removing finite field DH from HTTPS and I'm sure they will remove it
from WebRTC sooon if it's there at all. Firefox strongly favors the EC
suites too.

-Ekr