Re: [TLS] Confirming Consensus on removing RSA key Transport from TLS 1.3<

[[e-mail] (Martin Rex)]

Watson Ladd wrote:
>>
>> If RSA was weak, _any_single_use_ of RSA would make you "vulnerable",
>> not just the RSA encryption of the premaster secret, but in just the
>> same fashion the RSA signature on the (EC)DHE parameter in the
>> ServerKeyExchange handshake message.  Or the signatures on the
>> certificate chain, or the signatures on the OCSP responses or CRLs.
> 
> RSA signatures in the PKI are being increased in size to 2048 and 4096
> over the next few years to address this problem. This doesn't seem to
> be in the cards for static RSA because of the speed issues.
> 
> Furthermore, this is orthogonal to the issue of the fastest TLS
> handshake. RSA decryption is very slow, so you can do the two
> exponentiations to complete a P256 handshake and signing in the time
> to encrypt. The client doesn't matter: it is making very few
> connections, so can take a while to do the calculations.

When using an RSA server certificate the server can choose between having
to perform static RSA key exchange with an RSA private key (decryption)
operation on the RSA PremasterSecret or an RSA Private key (signature)
operation to sign the ServerKeyExchange handshake message
--and that signature covers ClientHello.random and ServerHello.random
so is unique per full handshake, just like the RSA decryption of the
Premaster secret.

Where exactly do you see a performance _advantage_ of an RSA-signed
(EC)DHE key exchange vs. an RSA-decrypted PremasterSecret?

-Martin