[TLS] TLS 1.1 and static DH

[Jan Nordqvist <jnordqvist@xxxxxxxxxx>]

Hi All,

We have an implementation of a TLS 1.0/1.1 stack for which we are 
seeking candidates for interoperability testing. None of the publicly 
available implementations that we have found implements TLS1.1 and we 
are therefore interested in getting access to a TLS implementation that 
does both TLS1.0 and TLS1.1 for interoperability testing and preferably 
also for regression testing.
Ideally we would like access to a trusted public domain implementation,
but as an alternative we could either consider access over the public
Internet or exchange a bundled test-suite with some other vendor under
an NDA.

Apart from the 1.1 support, an issue that surprises me somewhat is that
the static DH cipher suites, i.e. the TLS_DH_DSA and TLS_DH_RSA suites
rarely seems to be supported.
None of the TLS RFC's makes any statement, perhaps rightly, about
the AlgorithmIdentifier to use for DH keys in certificates. At the
same time it seems that X.509 DH certificates are somewhat arcane and I
have seen certificates using both 1.2.840.10046.2.1 (the X.509 suggested
dhpublicnumber) and  1.2.840.113549.1.3.1 (RSA/DH) as the
AlgorithmIdentifier as well as 1.2.840.113549.1.3.1 or
1.2.840.113549.1.5.16.1 (PKCS-8) for the private key id in the key-file.
Could it be that the lack of consistency here has something to do with
the lack of support for static DH in TLS?
Any comments or clarification here would be appreciated.

If anyone is interested in engaging in a mutual test setup, our interest
would involve testing out all of the RFC-4346 mandated cipher suites,
except the export suites, the Kerberos suites and the IDEA suite, with
and without client authentication, with and without "standard" stateful
session resumption and potentially stateful resumption per RFC-4507.

Thank you,

Jan Nordqvist
Software Architect
Lucent VitalAAA product group


_______________________________________________
TLS mailing list
TLS@xxxxxxxxxxxxxx
https://www1.ietf.org/mailman/listinfo/tls