[TLS] removal of nonces [was: What would make TLS cryptographically better for TLS 1.3]

[Nikos Mavrogiannopoulos <[e-mail]>]

On 11/01/2013 12:09 AM, Nico Williams wrote:

>  - Many fewer nonce bytes and random IVs where possible.  Nonce payloads
>    should be sent when needed, if needed.  For example, to derive a
>    session key from an DHE shared secret one does not really need
>    nonces.

Not really. Nonces are needed even in DHE ciphersuites. The nonces in
TLS make sure that the signatures from both parties are fresh and only
valid for this session (i.e., cannot be taken and re-used in another
session). See how PKINIT Kerberos has issues when used with smart cards,
just because it saved a round-trip by not sending a server nonce.

While one could select a message order in order to avoid using nonces by
using the DH public keys as such and maintain security (i.e., one cannot
save a round-trip), what would that buy? It would just make the TLS
shell weaker that would resemble less of a generic security protocol
with algorithm agility.

regards,
Nikos