[TLS] Channel ID and server load: comment on draft-balfanz-tls-channelid-00

[Watson Ladd <[e-mail]>]

Channel ID requires 2 modular exponentiations every handshake on the
server, even when sessions are resumed. The claimed argument for this
necessity is that resumption tickets could get stolen from the client.
Why could Channel ID identifiers not get stolen when the resumption
tickets are? Is there a reasonable threat model in which a client so
compromised as to lose resumption tickets has a meaningful benefit
from Channel ID?

Why P256 and ECDSA? These choices prevent batch verification on the
server, increasing the workload significantly. They do not have major
security advantages, or performance advantages over Ed25519.

When browsers implement Channel ID, what separations between different
websites are required? Cross-site request forgery has long been the
bane of web authentication technologies: does Channel ID provide
additional benefits here?
Sincerely,
Watson Ladd