Re: [TLS] TLS Charter Revision

[Trevor Perrin <[e-mail]>]

On Tue, Dec 3, 2013 at 8:08 PM, Watson Ladd <[e-mail]> wrote:
> On Tue, Dec 3, 2013 at 7:13 PM, Marsh Ray <[e-mail]> wrote:
>> From: TLS [mailto:[e-mail]] On Behalf Of Watson Ladd
>>
>>> I propose the following charter instead.
>>> "To create a protocol establishing a secure encrypted and authenticated channel in the
>>> standard model between parties A and B, supporting the following authentication methods:
>>> -One-way authentication with the PKI
>>> -Two-way authentication with the PKI
>>> -Two-way authentication with a shared low-entropy secret -One side authenticated with the PKI, and the other with a shared low-entropy secret.
>>> Said protocol will function over UDP and TCP with a minimum of handshakes, complexity, and options, and will have a formal security proof."
>>
>> Gee you make it sound so easy.
> What part do you think is hard? We've known how to do all of this
> since basically forever in cryptography terms, except the formal proof
> part, but
> that's automatic now. CurveCP has all of this working

It doesn't, actually.  CurveCP has some security flaws [1], no formal
proof, no PKI support, and lacks the low-round-trip properties that
are TLS 1.3 goals.

Key agreement remains a complex topic even in academia.  Trying to
balance low round-trips, computational efficiency,
handshake-data-hiding, implementation complexity,
backwards-compatibility, extensibility, IPR, etc. involves difficult
tradeoffs.

Anyways, I prefer Joseph's charter, as it identifies specific focuses
for improvement (round-trips, handshake-data-hiding), whereas yours is
quite vague ("minimum of handshakes, complexity, and options").


Trevor

[1] http://codesinchaos.wordpress.com/2012/09/09/curvecp-1/