Re: [TLS] OPTLS: Signature-less TLS 1.3

[Daniel Kahn Gillmor <[e-mail]>]

On Sun 2014-11-09 09:25:27 -1000, Martin Thomson wrote:
> On 8 November 2014 08:06, Daniel Kahn Gillmor <[e-mail]> wrote:
>> To achieve this separation of purpose, though, we'd need to be able to
>> distinguish between certificates capable of anchoring the end entity in
>> a TLS 1.2 session and certificates capable of certifying a long-term
>> g^s.  Making these distinguishable would probably require a new X.509v3
>> extension, or extendedKeyUsage.
>
> There may still be operational advantages: you could issue the 1.2
> cert with a shorter lifetime and the 1.3 cert with a longer one.

I'm not sure i understand this suggestion (it may be moot since it
sounds like we're not considering this approach for 1.3 anyway after
yesterday's interim discussion about the risks of introducing delegation
in this fashion).

> Mucking with X.509 would probably make this harder than its worth, I think.

i agree that X.509 is a disaster here, but i think making up a new
delegation protocol won't necessarily be a non-disaster -- we could
instead just rehash some of the sharp bits of the X.509 mess
(revocation, duration, transparency, identity, etc) in a different
format if we're not clear about what we're doing :/

           --dkg