Re: [TLS] Rethink TLS 1.3

[Ilari Liusvaara <[e-mail]>]

On Tue, Nov 25, 2014 at 02:19:53PM -0800, Watson Ladd wrote:
> 
> As for improvents, how about finding an existing, conservatively designed
> signature based key agreement mechanism with the right properties, and
> using it? The current proposal has two distinct client auth mechanisms, one
> in the handshake and the other in update.

The parts of TLS 1.3 that worry me the most are:

- Ensuring that implementations don't screw up the 2RTT case.
- Certificate authentication.

And yes, both worry me much more than key exchange.


Both are quite nasty problems, because it is difficult to capture
those in security model. And without security model, there can be no
security proof.

The certificate authentication is practicularly nasty because of the
interactions with TLS 1.2 certificate authentication (see the recent
message) and interactions with applications.

And yes, the current server authentication, the current client
authentication and the proposed client authentication via update all
have problems here.

E.g. With current scheme, trying to resume client-authenticated session
can go wrong. And the new scheme can have weird interactions with
applications if client authenticates midway.


-Ilari