OpenID Consumer: HTTPS + no-encryption association request?

Question

I'm implementing an OpenID consumer.

I'm wondering if it's safe to not use a Diffie-Hellman association request if the endpoint is accessed via HTTPS? I thought I'd read somewhere that it was redundant and that made sense to me, but would prefer to make sure.

Answer 1

In software security layers of redundant security is a good thing.

Answer 2

It is generally safe, unless you suspect that someone may have the ability to eavesdrop on your HTTPS connection -- and in such case, you probably have a more serious problem than OpenID security.