Re: [TLS] OPTLS: Signature-less TLS 1.3

[Hugo Krawczyk <[e-mail]>]

If you consider the t-mode of OPTLS I suggested in the previous email then
the changes relative to 1.2 are not much more significant than those
introduced in 1.3. Please think about this point. It is important! Right
now people are going through the process of digesting these ideas so it all
seems much more complex than they really are.

This is particularly true for the t-mode where the only thing that changes
w.r.t current TLS 1.3 is that servers generate keys g^s which they can do
as frequently or non-frequently as they wish, can support as many groups as
they wish, require no certification and raise no issues of delegation. The
rest is just a change of what you sign and the key derivation formulas. It
is hard to believe that this should be considered as changing things
radically. The fact that this enables the more forward looking r-mode
should be an advantage that servers can enjoy down the road (without yet
another revision of the protocol). In particular, the r-mode could be the
real incentive (together with 0-RTT, for those that need it) to move to
1.3. Currently, the only substantial thing that 1.3 is offering (other than
security improvements that people seem to consider less significant than
functional/performance improvements) is forward secrecy. I am not sure that
by itself it would be a strong enough incentive to upgrade.

Hugo


On Thu, Nov 13, 2014 at 1:18 PM, Salz, Rich <[e-mail]> wrote:

> I think the major concern is that this is a pretty radical change from the
> current deployment model of SSL/TLS.  For what it's worth, I think it's
> cool and clever and has a number of real nice properties. But we are
> already getting 'picked on' for adding too many new things, and I am
> concerned that adding this, fairly late in the game, will delay the
> deployment of TLS 1.3 as people will take a step back and consider if they
> really need to use this revolutionary new protocol, rather than the
> evolutionary changes they were expecting.
>
> I used my personal opinion here, but I feel pretty comfortable saying I'm
> not the only one who feels this way. It's a case of "too much, too late."
>
> Does that make sense?
>
> Can we wrap up TLS 1.3 and perhaps do a TLS 2 based on these concepts,
> including a  non-CA trust model?
>
>         /r$
>
>
>