Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It only takes a minute to sign up.
Sign up to join this community
In TLS 1.2 and TLS 1.3, does the EC curve used to generate the ephemeral keys at the client side, does it need to be the same as that on the and server sides?
For example can I use secp521r1 at the client side and secp256r1 at the server side, and visa-versa?
I am asking this question, since in TLS 1.2 you can use finite state DHE ciphers to generate the ephemeral keys on the client side and DHE_Export ciphers to generate the ephemeral keys on the server side, thus the Logjam attack.
In TLS 1.3, having a successful handshake with clients using different curves is impossible, besides only with negligible collision(s) in the key schedule/key derivation(page 93).
The reason is that the entire handshake which includes the ciphersuites is hashed and used in the key derivation. If the client and the server use different groups, this results in different keys. Furthermore, the server signs the handshake hash, so the CertificateVerify message(s) will likely not be accepted. Even if that was accepted for some reason, the Finished messages are overwhelmingly likely to fail. This is because the keys used to perform these steps are also derived from the handshake hash.
Therefore, because of all the steps that authenticate the handshake, it's nearly impossible to perform a Logjam type attack on TLS1.3. TLS1.2 is different but, it is very unlikely that two curves may successfully interoperate in the key exchange, besides for implementation issues.
