IETF Logo Mail Archive

Re: [TLS] I-D: TLS += Kerberos (provides Quantum Relief for DH)

Rick van Rein <rick@openfortress.nl> Tue, 25 February 2020 19:31 UTC

Return-Path: <rick@openfortress.nl>
X-Original-To: tls@ietfa.amsl.com
Delivered-To: tls@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5C3C73A141A for <tls@ietfa.amsl.com>; Tue, 25 Feb 2020 11:31:01 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.097
X-Spam-Level:
X-Spam-Status: No, score=-2.097 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=openfortress.nl
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vpa3HE9X9vZM for <tls@ietfa.amsl.com>; Tue, 25 Feb 2020 11:30:59 -0800 (PST)
Received: from lb1-smtp-cloud8.xs4all.net (lb1-smtp-cloud8.xs4all.net [194.109.24.21]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BC0903A139A for <tls@ietf.org>; Tue, 25 Feb 2020 11:30:58 -0800 (PST)
Received: from popmini.vanrein.org ([83.161.146.46]) by smtp-cloud8.xs4all.net with ESMTP id 6fuvjEiLzPKvK6fuwjqj6X; Tue, 25 Feb 2020 20:30:54 +0100
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=openfortress.nl; i=rick@openfortress.nl; q=dns/txt; s=fame; t=1582659044; h=message-id : date : from : mime-version : to : cc : subject : references : in-reply-to : content-type : content-transfer-encoding : date : from : subject; bh=xPa84fDUBFND8BLuwvngQgDmAICPsAm2JqOUPcHmczQ=; b=SipBU6EZGD0HKfLPGqMZWMDkQ8dY+B3NuXomvPShXI2rPWiTE8oseD+X B3Yr5T9Cjsufme2lMsz22oWsLFvYpAU7YTEexieQk5GNrGglEBv2eIxQhJ BB5eEiOqetlHh27NfXUI2zLkv1+Gin+M119XPoMh+bIMrfsPIsNzQ80Mw=
Received: by fame.vanrein.org (Postfix, from userid 1006) id 6DC18267F3; Tue, 25 Feb 2020 19:30:26 +0000 (UTC)
X-Original-To: tls@ietf.org
Received: from airhead.local (phantom.vanrein.org [83.161.146.46]) by fame.vanrein.org (Postfix) with ESMTPA id DAEAC26433; Tue, 25 Feb 2020 19:30:22 +0000 (UTC)
Message-ID: <5E5575CD.2040806@openfortress.nl>
Date: Tue, 25 Feb 2020 20:30:21 +0100
From: Rick van Rein <rick@openfortress.nl>
User-Agent: Postbox 3.0.11 (Macintosh/20140602)
MIME-Version: 1.0
To: "Salz, Rich" <rsalz@akamai.com>
CC: TLS WG <tls@ietf.org>, "Tom Vrancken (ARPA2)" <tom.vrancken@arpa2.org>
References: <5E54CDA0.8070209@openfortress.nl> <735DE784-87A7-4084-B804-C6199C3F5D49@akamai.com>
In-Reply-To: <735DE784-87A7-4084-B804-C6199C3F5D49@akamai.com>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 7bit
X-Bogosity: Unsure, tests=bogofilter, spamicity=0.520000, version=1.2.4
X-CMAE-Envelope: MS4wfPb1dL+QTNSFqkTKVkqxOkaq2nHpntOkkeoMMXWN3U1N7lQLhPDFDAHCVCJXPg811bqbrVeEGC+iODxSvJQEaOu0HRP8hAByWbFNPvJ0Mf1fghvJ9TNT U5Z37ETNDz0PUcEs6HRXOIY61h7q023EIlo3lcL1gsXX2xqRxqAf7x0r
Archived-At: <https://mailarchive.ietf.org/arch/msg/tls/H3vxkOw8pHEYjqRgITGBdl_VZmM>
Subject: Re: [TLS] I-D: TLS += Kerberos (provides Quantum Relief for DH)
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/tls/>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 25 Feb 2020 19:31:02 -0000

Hi Rich,

Salz, Rich wrote:
>      * Introduction of (anonymous) Kerberos tickets as added entropy to mix
>     with ECDH, and thereby provide Quantum Relief; it generalises this idea
>     to allow for other ways of adding entropy
>
> Have you seen https://datatracker.ietf.org/doc/draft-irtf-cfrg-randomness-improvements/ ?

I hadn't.  Are you suggesting to insert the session key, or anything derived from it, into this CPRNG-alternative mechanism?

The spec speaks of ways of communicating entropy, not necessarily having them available on two ends yet.  That's a mild generalistion over the idea of passing a Kerberos ticket, which is essentially the pupose of this proposal.  I am however listening here if the generalisation is useful.  (I do have a few immature ideas that could use it.)

-Rick

v2.23.0 | Report a Bug | By Email