Re: [TLS] OPTLS: Signature-less TLS 1.3

[Eric Rescorla <[e-mail]>]

On Mon, Nov 10, 2014 at 1:45 PM, Watson Ladd <[e-mail]> wrote:

>
> On Nov 10, 2014 3:30 PM, "Martin Thomson" <[e-mail]>
> wrote:
> >
> > On 10 November 2014 14:23, Daniel Kahn Gillmor <[e-mail]>
> wrote:
> > > i agree that X.509 is a disaster here, but i think making up a new
> > > delegation protocol won't necessarily be a non-disaster -- we could
> > > instead just rehash some of the sharp bits of the X.509 mess
> > > (revocation, duration, transparency, identity, etc) in a different
> > > format if we're not clear about what we're doing :/
> >
> > Prior to the discussion yesterday, I was really warming to this idea.
> > After it, particularly the discussion around the creation of a
> > delegation point, I think that I've been convinced that we shouldn't
> > do this.
>
> Every 0-RTT solution involves a similar delegation, as the client is using
> data sent from the server in the prevoius interaction or OOB to encrypt the
> early data.
>
Well, perhaps.

It's quite possible to have the server deliver a key in the initial
handshake that
is usable by the client for future handshakes. However, if the
authentication
of that key is part of the initial handshake (e.g., it's signed as part of
the
transcript), then the key won't be usable by other clients [or more
accurately,
the client won't be able to hand it to other clients and get them to use
it].

I suppose you could argue that this is a delegation, but if so it's a
different
sort of delegation than producing a freestanding credential that can be
given out to any new client.

-Ekr