Re: [TLS] Confirming Consensus on removing RSA key Transport from TLS 1.3

[Alyssa Rowan <[e-mail]>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

On 27 March 2014 12:37:43 GMT+00:00, Paul Bakker <[e-mail]> wrote:

>Other key exchanges, such as pure PSK have their value in very-low-resource
>situations.

Hmm. Where you're low resource enough to have to pre-share keys, you're specifying your own profile because you know exactly what's connecting (otherwise you couldn't pre-share keys with it).

I don't think that's suitably applicable to the general profile for TLS on the internet.

Maybe, if you're that constrained, you don't *really* want TLS and its x.509 luggage at all: AES-GCM or ChaCha20-Poly1305 and a monotonic counter nonce? And if you want forward security, and you probably should, then you probably want... curve25519.

I certainly don't see how that's a good argument for keeping DHE around, which is the fattest of the key exchanges. Seems rather like the opposite, actually.

>And I think it's never a good idea to depend on a single key exchange
>scheme, for future security robustness.

Agreed, which is part of why I suggested ECDHE over *two* curves: djb's fast curve25519, and NIST's already-deployed and 'Suite Beatified' secp256r1. They're fairly different.

We can specify further ones in future if (and hopefully in advance of when) problems arise. Specifying several exchanges might potentially make us vulnerable to the difficulties of both, if the attacker gets to pick which. We *should* safely avoid that of course, but it should be kept in mind.

- --
/akr
-----BEGIN PGP SIGNATURE-----
Version: APG v1.1.1

iQI3BAEBCgAhBQJTNCCWGhxBbHlzc2EgUm93YW4gPGFrckBha3IuaW8+AAoJEOyE
jtkWi2t6EzkQAKJJOpH7xSKAzcP+ENVAMtO3wD+u5z2Q8JLPTwGc4+x+vo8hsPk6
rFXqt2311ENAkGdft99eD7n8xSF03a/WVnSNv6pn20XLeJhXiWPyv6m2onL8+Kv0
wAQbkIp6WN1bb4BvlQ9EVYTWFmxIEZpCW7A1ebi95sdi/Z+ctwS6F5AYBn3DQx2Z
2UVGS0idrcXA1F1js31WfPEggYsAf9AH9jpBV6Ya3233KdGYqlptx4o9vLDY3lZn
yojcYKPcRg6e1hCGkTUYr/cckj3qnal3oHjKQBrILRysxPKm4KavDzVRjvrMgwBU
C4sQP+mQHm9+ynYcYySrur0uD5f8tFdCgYOHJa3gj9eppfufZxt303SOuLbbyW6k
Qoryg/YNeZ6kvIyLRqxbVNACBYamNwVZxnNedZm10VfW6FSr7AE1m58PFyCK8Wu2
v7tacmnCVe+zl6KHKLDcnTaS2iRdM1QwUBOoTdcxvlRddzJTPi0cs5ghRbs5ZCpM
fTIaNVGcVPx1GuNUpWu6rhA3U+E+oMojmyVMjJEHQWYXryJoi0MCS+TW0MInrGfW
uD4qt2P7RltmZw+qsRKuv6yKs+904LpFqsyMZa+DFVMis5ntvBBMIpyp3eNDX8A/
SpqSypLovgVRKc3oA8TTwvTU+jucVDIUHwU2YQC+gr68rI5gg2wmWuL1
=IABy
-----END PGP SIGNATURE-----