Re: [Cfrg] When TLS is an overkill...

[Ruslan Kiyanchuk <[e-mail]>]

> What I am trying to do is quite simple: /provide a building block that
> developers and engineers can use to secure the communication between
> two peers by using a low number of messages/.
>
> In particular, I think that this building block could help many
> developers to do the right thing when not using TLS. Do not get me
> wrong, TLS is great.. however, it might be useful to have an
> alternative. My particular use case (but this is just one, there might
> be many others) is specifically EAP. In EAP, it seems, people always
> try to re-use
>
I think you might be trying to reinvent Noise protocol framework
<http://www.noiseprotocol.org/> :)

It's a framework designed to be simple and straightforward for for
securing 2-party communication. By combining different elements of the
protocol you achieve various security properties. There is also a third
party website Noise Explorer <https://noiseexplorer.com/> where you can
explore various settings of the framework and corresponding security
properties.

By your description so far it sounded like a good fit.

Another mention that may be relevant is Google's ATLS
<https://cloud.google.com/security/encryption-in-transit/application-layer-transport-security/>
(it's their home-grown TLS alternative, I'm not aware how much scrutiny
and analysis it underwent).

Good luck!