Re: [TLS] Rethink TLS 1.3

[Nico Williams <[e-mail]>]

On Sun, Nov 23, 2014 at 02:27:25PM +0100, Ralph Holz wrote:
> I'd disagree with the notion of "it is clear what TLS supports" - there is
> no threat model describing the strength of an attacker (and there never has
> been). It's not even clear what TLS means by "authentication".

This is true, and it is partly why we need algorithm agility: to
trade-off performance/cost for security in a context-sensitive manner.

Network security is an extension of physical security (if your hardware
or the software it runs aren't secure...).  If we assume physical
security (a big assumption) then we can get perfect security at very
high cost: e.g., every communicating pair of nodes meets physically to
securely exchange one time pads.  But we know that's too costly (it
doesn't scale, for one), so out the window goes perfection.  Everything
we're doing (DNSSEC, DPRIV, CT, ...) is just an exercise in
asymptotically approaching perfection.

> As a possible step forward, we could say TLS supports authentication as
> Lowe's injective agreement - a fairly strong definition yet one matching
> intuitive expectation.

That's implied in the Internet threat model, really.  We should make
some things more explicit, of course (e.g., we need liveness).  Of
course, in some cases we are willing to trade some features off (e.g.,
certificate status freshness tolerance vs. performance, or 0-RTT early
data transmission).

See above about trade-offs.

Nico
--