[rtcweb] Unlinkability and RSA

[Watson Ladd <[e-mail]>]

Dear all,

draft-ietf-rtcweb-security-arch-09 asks "[[OPEN ISSUE: Are these the
right cipher suites?]]" and then describes two RSA suites. They are
secure, but slow, and certificates need to be regenerated frequently
to preserve unlinkability. ECDSA is much more performant, and this
would ameliorate issues relating to certificate regeneration
performance on low-power devices, as well as enable lower-power CPUs
on video devices that intend to interoperate, via custom signalling,
with webRTC.

Secondly, ditch DHE. If you have ECDSA, you have everything for ECDHE,
and it avoids slow, frequently skipped, and necessary checks in the
protocol. I can think of no reason to use it.

Thanks to Justin Uberti for pointing out this issue and the
unlinkability consequences on constrained devices.
Sincerely,
Watson Ladd