[TLS] Rethink TLS 1.3

[Watson Ladd <[e-mail]>]

Was the TLS 1.3 draft written by a cryptographer? No.
Has it been reviewed by cryptographers? Unclear.
Are the mechanisms secure? Unknown.
Is it easy to analyze TLS 1.2? No.
Was TLS 1.2 secure? No.
Has TLS 1.3 fixed flaws in TLS 1.2? Some: session_hash remains
unincluded, but the record layer is finally fixed.
How long will it take to analyze TLS 1.3? If past experience is any
guide, a decade.

Can we fix problems in deployed protocols? No.
Will TLS 1.3 be deployed? Yes.

Putting this together, it seems clear that substantially more
attention needs to be paid to TLS 1.3 before we deploy it. A delay is
inevitable. Even if we decide not to proceed with OPTLS, we need to
make sure that there is a substantial degree of analysis of the
protocol before, not after, it is deployed, and that it is designed to
help, not hinder, analysis.

The current draft is not in a state where it describes a protocol that
we can analyze or implement. The sooner it gets to that state, the
sooner we can start seriously finding problems or showing there are
none. But we shouldn't expect that this process will be overnight:
it's much faster to start with a good protocol and serialize each of
the messages, instead of starting with mystery, figuring out what it
actually does, and trying to show the result is correct (and
discovering it isn't).

Sincerely,
Watson Ladd