Re: [Cfrg] Security proofs v DH backdoors

[Peter Gutmann <[e-mail]>]

Ilari Liusvaara <[e-mail]> writes:

>Do the devices need to interop with web browsers?

The devices need to talk to each other, and comply with various SCADA
standards (IEC 62351-3 is one that springs to mind, but there are lots of
industry-specific standards and profiles).  What web browsers do ranks some
way down the list of priorities, about the level of an also-ran consideration.

>- If no, then you should be using top-edge TLS or something non-TLS that
>  is competently designed (esp. on constrained environments, as TLS is
>  not very economical there, even with pure-PSK).

This was more or less the same response that some embedded folks got on the
HTTP/2 list when they asked for some very minor changes to make HTTP/2 usable
with embedded, "let them eat HTTP 1.1".  The people driving HTTP/2 basically
said "we don't care about you, we're only designing for the web" (thus the
tongue-in-cheek name of HTTP/2, "HTTP4Google").  This is probably also why
there are approximately, oh, zero embedded folks contributing to the TLS list
(there are several in read-only mode, I'm not aware of anyone contributing
publicly).

>What libraries would implement that? 

Implement what?

Peter.