[TLS] Re: NIST TLS recomendations

[Simon Josefsson <jas@xxxxxxxxxxx>]

Ray Perlner <ray.perlner@xxxxxxxx> writes:

> Page 81 Section A5.
> This section deprecates anonymous DH, which hopefully means that no
> compliant version of TLS 1.2 will support this mode, (or any other
> completely anonymous mode.)

I don't read A5 that way.

Section A5 suggests (but no MUST NOT) that DH_anon for RC4/DES/3DES is
deprecated, which I'd agree to.

However, section A5 appear to permit DH_anon with AES128/AES256.

I believe fully anonymous ciphers are a useful feature of TLS, and
that they should stay.  Client/server authentication can and do happen
via other protocols than TLS, and those protocols can use TLS channel
bindings to protect against man in the middle attacks, if necessary.

/Simon

_______________________________________________
TLS mailing list
TLS@xxxxxxxxxxxxxx
https://www1.ietf.org/mailman/listinfo/tls