Re: [TLS] Re-thinking OPTLS

[Hugo Krawczyk <[e-mail]>]

On Mon, Nov 24, 2014 at 1:33 AM, Nico Williams <[e-mail]>
wrote:

>
> I'm in favor of using static server (EC)DH keys for server
> authentication and possible 0-RTT, particularly in connection
> with DANE.
>
> I *don't* think that OPTLS is worthwhile without connection to DANE, but
> only because OPTLS is just an optimization with roughly the same
> applicability as an existing optimization that is much faster: session
> resumption [with encrypted session state tickets].
>

​Session resumption is indeed faster if you don't do PFS - otherwise it is
still faster but not by much.
And of course, as I'm sure you agree, there are 0-RTT scenarios that cannot
be  reduced to session resumption as in the QUIC case mentioned by AGL or
any setting where keeping a shared secret state at the client is not
practical.

Hugo
​

>
> But since I think sprinkling DANE on is the obvious thing to do given
> OPTLS as part of the protocol, I'm in favor.
>
> Security-wise the use of static (EC)DH keys is well-understood (as well
> understood as (EC)DH is in general).
>
> The g^xs plus (not the arithmetic operator) g^xy method of obtaining PFS
> is also OK, and heck, if need be the client could use two different x's,
> and the protocol ought to allow it (not least because the client might
> want to use different groups/ curves for PFS key agreement than for
> authentication key agreement).
>
> Nico
> --
>