Re: [TLS] Confirming Consensus on removing RSA key Transport from TLS 1.3

[[e-mail] (Martin Rex)]

Joseph Salowey (jsalowey) wrote:
>
> The discussion on this list and others supports the consensus in IETF 89
> to remove RSA key transport cipher suites from TLS 1.3.

You probably meant TLS cipher suites with the (static) RSA key exchange
method.

> 
> More discussion is needed on both DH and ECDH are used going forward
> and on if standard DHE parameters will be specified.

(static) DH/ECDH key exchange needs to be addressed seperately from 
(ephemeral) DHE/ECDHE key exchange.

Is there any deployment of Server certificates with static DH/ECDH at all?
Is it at all possible to build a regular PKCS#10 certification request
(i.e. one with a proof-of-posession signature) for static DH/ECDH
keys in server certificates?


Personally, I don't think it is reasonable to completely remove from TLSv1.3
*ALL* of the stuff that will be necessary for interop with the installed base.

There also exist small devices with weak random number generators that
could be used with an offline generated RSA server keypair.  I don't see
any value in _not_ supporting static RSA for these.  With a preloaded
strong (EC)DHE keypair, they're worse off that with a static RSA key
(slower and no forward secrecy), and they have difficulties generating
strong ephemeral keys on their own.


The additional code footprint of ECC and the overall brittleness
of ECC crypto is another concern.  Currently, ECC is a mere option,
and a very dangerous one due to the overall brittleness of ECC,
even for implementations of TLSv1.2


-Martin