Re: [TLS] the idea of using multiple keys with multiple certificate authorities in a TLS session.

[Ilari Liusvaara <[e-mail]>]

On Thu, Feb 05, 2015 at 12:47:17PM +0330, Shahin Noursalehi wrote:
> Dear Sir/Madam,
> 
> Refer to discussions around TLS 1.3 in Linkedin group "Cryptographers
> and Cryptanalysts", contributor experts agree on the idea of using
> multiple keys with multiple certificate authorities in a TLS session.
> So if one certificate authority is compromised hopefully the others
> are not. The suggested solution would be like the process bellow:
> 
> Refer to the way that TLS generates the *master_secret*:
> 
> master_secret = PseudoRandomFunction(pre_master_secret, "master
> secret", ClientHello.random + ServerHello.random)

TLS 1.3 fixed a mistake (security problem) in this, it is now:

master_secret = PRF(pre_master_secret, "handshake master secret",
hash(handshake))

> We could generate multiple peer-to-peer pre_master_secret(s) for each
> public-key that we receive from the server and XOR them all together.
> So, our offered method of calculation of master_secret will convert
> to:

You don't need multiple premaster secrets. One could just end the
certificate chains in common host key. This way one only needs a
new certificate format and no other changes to TLS. It would also
work in earlier versions.

Of course, it seems doubtful to me that multiple certificate
chains are useful.


-Ilari