Re: [TLS] CPU cost of 1RTT handshake

[Eric Rescorla <[e-mail]>]

On Sun, Aug 10, 2014 at 9:28 PM, Watson Ladd <[e-mail]> wrote:
>
>  > 2. The client is not forced to send any shares. It can simply send
> > an empty ClientKeyExchange (See S 7.4.2) and then wait for the
> > server to select a group. In other words, it can act as you suggest
> > above, but at the cost of a round trip. It's a explicit computation/
> > latency tradeoff.
>
> It's a completely unnecessary one: the server can send its share, then
> the client goes, which is followed by the remaining messages.


Yes, one could do that, but it has different properties:

1. It doesn't allow the server to encrypt its handshake data on
the first flight and therefore does not conceal it from passive
observers [0]

2. It doesn't allow the server to send data to the client on its first
flight (if it doesn't care about the client's identity).

-Ekr

[0] Or active observers in cases like WebRTC where the server
doesn't respond to any client.