Re: [TLS] Should we support static RSA in TLS 1.3?

[Peter Gutmann <[e-mail]>]

Phillip Hallam-Baker <[e-mail]> writes:

>The goal here is not so much forward secrecy as to increase the work factor
>for an attacker. We have been considering short lived certs as a mechanism
>for addressing the revocation issue for some time. Generating a new cert with
>a different key each time does not increase the effort a great deal if it is
>thought about at the start.

There's been an RFC draft for this around pretty much forever, specifically:

  Some years ago I proposed a simple extension to X.509 to allow users to
  issue their own encryption certificates which they could renew and roll over
  as required. This means that it's no longer necessary to ask a CA for
  permission to encrypt data, keys can be rolled over regularly at no cost,
  and if a key is compromised it can be quickly replaced. This proposal was
  rejected by the PKIX working group with the comment that "we don't want to
  turn X.509 into PGP".

  http://www.cs.auckland.ac.nz/~pgut001/pubs/autonomous.txt

So it's pretty straightforward to do, the only thing is that it couldn't be
done by the PKIX working group, or whatever undead zombie form it's currently
continuing as.

Peter.