Re: [TLS] Confirming Consensus on removing RSA key Transport from TLS 1.3

[Trevor Perrin <[e-mail]>]

Hi Joe,

Could you explain what the process for TLS 1.3 is?

It seems like you want the group to start making lots of small,
specific decisions.  I'm not convinced that's the best way to design a
complex protocol with lots of inter-related pieces.

I was hoping we'd have some discussion on the TLS 1.3 process, now
that the charter is approved.  Is that not going to happen?


Trevor



On Wed, Mar 26, 2014 at 11:43 AM, Joseph Salowey (jsalowey)
<[e-mail]> wrote:
> TLS has had cipher suites based on RSA key transport (aka "static RSA", TLS_RSA_WITH_*) since the days of SSL 2.0.   These cipher suites have several drawbacks including lack of PFS, pre-master secret contributed only by the client, and the general weakening of RSA over time.  It would make the security analysis simpler to remove this option from TLS 1.3.  RSA certificates would still be allowed, but the key establishment would be via DHE or ECDHE.  The consensus in the room at IETF-89 was to remove RSA key transport from TLS 1.3.  If you have concerns about this decision please respond on the TLS list by April 11, 2014.
>
> Thanks,
>
> Joe
> [Speaking for the TLS chairs]
> _______________________________________________
> TLS mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/tls