Re: [TLS] OPTLS: Signature-less TLS 1.3

[Martin Thomson <[e-mail]>]

On 6 November 2014 01:34, Hugo Krawczyk <[e-mail]> wrote:
> Regarding the problems with insecure time, it seems that we are reaching
> agreement that this should not be a distraction for judging this proposal
> (in particular since it does not make things worse than the reliance of time
> synchronization for accepting certificates - and it can actually make things
> better by having shorter validity periods for the static DH key than for the
> long-term certificate).


I think that, based on this discussion, I've concluded that there
needs to be some sort of expiration bound to the signature over g^s.
That at least allows servers to limit the duration of an exposure in
the cases where g^s has to reside outside the HSM.  At worst, the only
concern is clock skew if the server wants to closely replicate online
signing.

Adding an expiration is a fairly trivial tweak.  Other than that, I
think that I'm happy with this being - on balance - worth doing.  I
haven't made up my mind whether the lack of a signature over a peer's
credentials is a good or bad thing entirely.  I like the idea of
deniability, but non-repudiation in general is a hazardous business.