Re: [Lake] [lake-wg/reqs] Placeholder for resumption (e743c87)

[Michael Richardson <[e-mail]>]

Taking this to the list.

    ekr> This seems like generally good text, but I feel like perhaps there is
    ekr> another angle on it, specifically, whether it should be possible to do
    ekr> a new AKE exchange efficiently.

    > Perhaps
    > "The AKE shall provide a mechanism to use the output of one handshake
    > to optimize future handshakes, e.g., by generating keying material
    > which can be used to authenticate a future handshake, thus avoiding the
    > need for public key authentication in that handshake".

EKR, there is some subtly here.
The text speaks about avoiding public key authentication.
I'm unclear if that include DH exponentiation or not.

Your question begs a more general question, which I think speaks to 'session
resumption' situation, I think.

And I guess there is distinction between:
  1) avoiding expensive authentication, assuming a round for PFS.
  2) avoiding expensive authentication, no PFS
  3) re-establishing state after a restart, or a long sleep.
     (the responder might have expired the session data)
  4) doing an exchange to rekey for PFS

(3) is different in a connectionless CoAP situation where there isn't a TCP
session to maintain.  Do we include mechanism in AKE, integrating into
OSCORE, such the responder initiates a session resume when it sees an OSCORE
context that it does not recognize?

--
Michael Richardson <[e-mail]>, Sandelman Software Works
 -= IPv6 IoT consulting =-