Re: [TLS] OPTLS: Signature-less TLS 1.3

[Daniel Kahn Gillmor <[e-mail]>]

On Thu 2014-11-06 01:54:11 -0500, Eric Rescorla wrote:
> if the signing key is online (as will be required for TLS 1.2 compat)
> compromise of the machine will let you sign a DH share with a very
> long lifetime.

It's conceivable that the online key for TLS 1.2 compatibility could be
one that is not the same as one that is used for signing g^s.

To achieve this separation of purpose, though, we'd need to be able to
distinguish between certificates capable of anchoring the end entity in
a TLS 1.2 session and certificates capable of certifying a long-term
g^s.  Making these distinguishable would probably require a new X.509v3
extension, or extendedKeyUsage.

So we're back to fiddling with X.509, if we want to avoid the described
attack :/

       --dkg