Re: [TLS] OPTLS: Signature-less TLS 1.3

[Yoav Nir <[e-mail]>]

> On Nov 11, 2014, at 7:33 AM, Nico Williams <[e-mail]> wrote:
> 
>> So what is the concern that has been voiced regarding the use of sub-certs
>> for g^s? That the leakage of a private key s that was sub-certified allows
>> [...]
> 
> That the "sub-cert" needs either a revocation scheme (not likely) or a
> short lifetime.  The latter puts this on a par with session resumption,
> thus making one (well, me) wonder what the advantage to the static DH
> concept would be.

There is a revocation scheme. If the private ECDH key is lost, you revoke the certificate, thereby invalidating the delegation.

> We could put static DH keys in DNSSEC and learn them that way, which
> would get us 0rt.

Another possibility is to place the ECDH public key in a certificate extension. This gives it a lifetime as long as the certificate, and it doesn’t matter whether the “regular” certificate public key is RSA or ECDSA or anything else. 

It removes the need to use signatures at all by the server. Not even once.

Yoav