Re: [TLS] Should we support static RSA in TLS 1.3?

[Watson Ladd <[e-mail]>]

On Sat, Nov 16, 2013 at 9:03 PM, Eric Rescorla <[e-mail]> wrote:
>
>
>
> On Sat, Nov 16, 2013 at 8:32 PM, Watson Ladd <[e-mail]> wrote:
>>
>> I think that we need a better idea of the problem we are trying to solve.
>> Trading computation for latency by going to ECDSA/RSA signing certs
>> and signing a Diffie-Hellman exchange is a good idea for Google and the
>> web,
>> but not so for embedded devices.
>
>
> TLS is extensively used in both settings.
Actually, I take back what I said. ECC is much, much faster than RSA
on small devices
especially with hardware support. Static DH could be of interest here.
>
> That said, using ephemeral keying doesn't really improve latency
> that much. There are a number of cases to consider, but off the top
> of my head you get between 0-1/2 RTT by switching to ephemeral
> exchange, depending on how much information the client has
> about the server.
If you use a signature, rather than an encrypted message, you get
three passes rather than four, and can send
arbitrary client data in the third pass that is authenticated and
encrypted. This is effectively a 1-RT protocol if
the client goes first in the application layer.

Sincerely,
Watson


-- 
"Those who would give up Essential Liberty to purchase a little
Temporary Safety deserve neither  Liberty nor Safety."
-- Benjamin Franklin