Re: [TLS] Confirming Consensus on removing RSA key Transport from TLS 1.3

["Paul Bakker" <[e-mail]>]

> Suggestion: remove static RSA *and* traditional DHE and mandate ECDHE for
> key exchange in TLS 1.3. I propose,
>  curve25519 as mandatory-to-implement and secp256r1 as recommended-
> to-implement [? Also mandatory, maybe?], both in constant time, which is
> comparatively easy, especially for 25519.

Let's not do that.. The world is bigger that 'Fat clients'. Other key exchanges, such as pure PSK have their value in very-low-resource situations.
And I think it's never a good idea to depend on a single key exchange scheme, for future security robustness.

> That would simplify the protocol considerably (decreasing the code and
> protocol surface to audit), increase its baseline security well above 2048-bit
> DH, to ~3072-bit (ish) levels, reduce the size of the exchanges and massively
> reduce the CPU load on both servers and clients.

I do agree that we should make the core as secure as possible, but we should keep all kinds of clients and servers in mind..

Paul Bakker