Re: [TLS] draft-sheffer-tls-bcp: DH recommendations

[[e-mail] (Martin Rex)]

Following up to myself:

> 
> The TLS WG could have easly provided an adequate PFS solution
> many years ago that could be trivially enabled for all existing
> implementations.  Ephermeral RSA.  99% of the code is already
> present in all implementations, because this is used in the
> RSA_EXP cipher suites.
> 
>   http://www.ietf.org/mail-archive/web/tls/current/msg01541.html
> 
> (EC)DHE is a mess, because both, servers and clients will regularly
> have to regenerate new keys, and there are going to be severl 
> different keys necessary for the preferences of various servers
> and sometimes, the client-side key generation will have to be
> performed inline.  How many different keys will clients need
> for ECDHE?
> 
> With Ephemeral RSA, only the server has to generate the temporary
> RSA keypair, and can *ALWAYS* generate the ephemeral RSA keypair out-of-band.

What I had not remembered from the past discussion, and just
found in a later reply from EKR:
   http://www.ietf.org/mail-archive/web/tls/current/msg01556.html

was the design "feature" (I believe it is a defect), that
the ephemeral key exchange in the server key exchange handshake
message exists only in a an exteremely paranoid variant, requiring
an additional private key operation for every handshake.

It would really help if client and server could negotiate the use
of alternative "signed parameters format" for ephemeral (RSA) keys
that do not require a seperate signature (=private key operation)
for each handshake, but where the signed parameters could be reused
for several hours, maybe using a time-based indicator for the
freshness of the ephemeral keypair.


-Martin