Re: [TLS] Rethink TLS 1.3

[Peter Gutmann <[e-mail]>]

Nico Williams <[e-mail]> writes:

>That's changing the subject.  

It's not changing the subject, which as far as I was aware was "do we have a
threat model to evaluate TLS 1.3 against?".

>Where have I argued that the web security mode is great or even permitted by
>the Internet threat model.

What's the web security mode?  What's the Internet threat model (if it isn't
the Strawman Model I mentioned earlier), and why does it permit or not permit
something?

>The web security model is... unlike anything produced by the IETF, and it
>wasn't produced by the IETF.  It's an alien as far as we're concerned here.

Given that HTTP 2.0 and to a lesser extent TLS 1.3 are being designed as if
the only thing that mattered is web browsers, they had better be useful with
or for or in the web security model, whatever that is.

What I want is a realistic, real-world threat model against which to evaluate
TLS 1.3.  Without a way to evaluate whether TLS 1.3 is fit for purpose, we're
just, to quote Linus, "a bunch of people wanking around with their opinions".

Peter.