Re: [TLS] OPTLS: Signature-less TLS 1.3

[Hugo Krawczyk <[e-mail]>]

On Mon, Nov 3, 2014 at 12:38 AM, Eric Rescorla <[e-mail]> wrote:

>
>
> On Sun, Nov 2, 2014 at 2:24 PM, Hugo Krawczyk <[e-mail]>
> wrote:
>
>>
>>
>> On Sat, Nov 1, 2014 at 7:15 AM, Watson Ladd <[e-mail]>
>> wrote:
>>
>>> Dear Hugo,
>>>
>>> There are some issues I can see:
>>>
>>> -Servers already supporting ECDSA certificates seem to not win. If I'm
>>> understanding correctly, a server does three exponentiations, one of
>>> which can be optimized by ephemeral reuse, when using ECDSA+ECDHE. The
>>> servers that win are the ones with RSA certs. The only way to win vs
>>> ECDSA is if DH only permits faster exponentiation, which it does, and
>>> removing the ancillary junk in ECDSA.  However, here we have two
>>> variable base exponentiations after ephemeral reuse, as opposed to one
>>> fixed, one variable, so there is a loss in performance on the same
>>> group, made up for by removing inversions modulo the group order.
>>>
>>
>> ​Don't forget that 0-RTT cannot be supported with a signature-based
>> protocol
>>
>
> I'm not sure that this is correct. If a client does a 1-RTT exchange first
> (which he will have to do if he is naive about the server) then the
> server can provide a semi-static DH key for future use at that time
> and use a signature over the entire transcript to authenticate it, no?
>

​When I said that "0-RTT cannot be supported with a signature-based
protocol"
I meant to say that the key exchanged in the 0-RTT client-to-server message
(used to encrypt ClientData) cannot be authenticated by a server's
session-specific signature and therefore it must use a DH-based mechanism
(or other PK encryption). A signature by the server can still be used to
sign the
semi-static key as you point out but that's an offline signature.
Or maybe I misunderstood your point?
​


>
> -Ekr
>
>