Re: [TLS] Remove DH-based 0-RTT

[Dave Garrett <[e-mail]>]

On Tuesday, February 23, 2016 02:03:53 pm Martin Thomson wrote:
> I propose that we remove DH-based 0-RTT from TLS 1.3.
> 
> As ekr's previous mail noted, the security properties of PSK-based
> 0-RTT and DH-based 0-RTT are almost identical.  And DH-based 0-RTT is
> much more complex.
> 
> For those who love DH-based 0-RTT, and I know that some people are
> fans, here's something that might make you less sad about removing it
> from the core spec.  You can use DH out of band to negotiate a PSK.
> You might even do this as an extension to TLS, but that's of less
> value.

I think there is a good argument for moving DH 0RTT into a TLS extension. Implementations that are explicitly not going to use it should not be expected to implement it and risk screwing it up. If we accept that premise that online DH 0RTT will be unlikely in practice, then we would be specifying it at least primarily for out-of-band use, and doing it via an extension will probably be cleaner and safer.

I would still prefer it be defined in the TLS 1.3 specification document, though optional.


Dave