Re: [Cfrg] Security proofs v DH backdoors

[Ilari Liusvaara <[e-mail]>]

On Sun, Oct 30, 2016 at 11:04:48AM +0000, Peter Gutmann wrote:
> Ilari Liusvaara <[e-mail]> writes:
> 
> >Unfortunately, LTS is a non-starter as web browsers are concerned. 
> 
> Sure, and if you read the -LTS draft you'll see it's not targeted at web
> browsers.  I know that this is probably hard for some people to understand,
> but there's a lot (an awful lot) of TLS used outside of web browsers.
> Unfortunately, like HTTP/2, this use seems to be mostly ignored (in HTTP/2 it
> was explicitly ignored, the response on the WG was "let them eat HTTP 1.1"
> when the matter was brought up).

Do the devices need to interop with web browsers? 

- If yes, those devices should be designed with newest specs (because
  otherwise those things likely will become stale an cause security
  headaches for _others_). Oh, and ECC asymmetric crypto is the lightest
  here.
- If no, then you should be using top-edge TLS or something non-TLS that
  is competently designed (esp. on constrained environments, as TLS is
  not very economical there, even with pure-PSK).

> >And it is pretty much non-starter as far as everything else is concerned.
> 
> Do you have any basis for saying this, or are you just, I dunno, making random
> statements?

What libraries would implement that? TLS is not exactly simple to
implement. As evidenced by plenty of implementations with very basic
flaws (e.g. not sequencing the handshake properly, or not checking
MACs).

> >It also does not fix the reasons why web browers [...]
> >
> >Heck, the web browser vendors don't seem to [...]
> 
> As I've already said, there are lots of uses of TLS outside of web browsers.
> 
> Yes, it's true, there are!  

Well, I know: I regularly have non-web TLS connections open, some even
with a client certificate.

> TLS 1.3/2.0/whatever-it'll-be-called is TLS-for-web-browsers (and content
> providers serving them).  TLS-LTS is TLS for everyone else.

What you think in TLS 1.3 is unsuitable for other usecases (excepting
quite constrained ones, where TLS (any version) is generally overly
complcated).


-Ilari