Re: [TLS] OPTLS: Signature-less TLS 1.3

[Nico Williams <[e-mail]>]

On Mon, Nov 10, 2014 at 07:51:25PM -1000, Daniel Kahn Gillmor wrote:
> On 11/10/2014 04:12 PM, Nico Williams wrote:
> > The time should be relative, as a TTL.
> 
> relative to what?

Relative to the time the server made the signature.  The signature might
need to be taken over a payload that includes a timestamp (see NTP
thread) and/or a nonce from the client.

> If the credential is standalone (e.g. in such a way that the signing key
> can be kept offline) then the TTL established can be replayed by an
> attacker who takes control of the DH secret to extend the lifetime of
> the delegated credential, right?

It has to be tied to the delegation act, the signature made with the
delegator credential.

> if the credential isn't standalone (i.e. if it's accepted by the client
> based on its inclusion in the signed handshake which has been
> authenticated by a signature from the signing key), then we aren't in a
> signature-less TLS scheme.

Well, sure we are: most of the time, just not all of the time.

> if it's not relative, but it's long-lived, then we introduce a new
> revocation problem.  if it's not relative and it is short-lived, then we
> introduce interesting clock skew issues (though perhaps those are the
> same as OCSP-must-staple clock skew issues?)

Right.

Nico
--