Re: [TLS] TLS 1.1 and static DH

[Nelson B Bolyard <nelson@xxxxxxxxxxx>]

(My apologies if you receive two copies of this email.)

Bodo Moeller wrote:
> On Wed, Oct 25, 2006 at 01:28:53PM +0300, Pasi.Eronen@xxxxxxxxx wrote:
>> pgut001@xxxxxxxxxxxxxxxxx wrote:
> 
>>> cryptlib definitely doesn't do static DH... in fact does anything?
>>> Why would anyone do it at all, for that matter?
> 
>> Based on a quick look at the source code, at least OpenSSL, Mozilla
>> NSS, and PureTLS appear to support static DH. 
>>
>> But I don't know why they do it either (or whether that part of the
>> code has actually ever been used or tested :-)
> 
> OpenSSL doesn't support static DH, actually.  

Neither does NSS.  The static DH cipher suites are explicitly disabled,
although much of the code necessary to support them is present in NSS.

> There's anonymous and
> non-anonymous ephemeral DH, there's static and ephemeral ECDH, but no
> static DH with DH certificates.  (There's also some code that doesn't
> totally neglect the possibility of having DH certificates, but this
> doesn't mean it is actually used anywhere.)

Likewise, NSS has code to parse (and even create) DH certificates, but
it is untested and unused because in the 10 years I've worked on NSS,
I've never seen a DH cert from any CA.  The Fortezza certs were DH certs,
but they were a rather special case, and the special case Fortezza code
is no longer supported in NSS.

-- 
Nelson B


_______________________________________________
TLS mailing list
TLS@xxxxxxxxxxxxxx
https://www1.ietf.org/mailman/listinfo/tls