Re: [TLS] OPTLS: Signature-less TLS 1.3

[Yoav Nir <[e-mail]>]

> On Nov 10, 2014, at 1:45 PM, Watson Ladd <[e-mail]> wrote:
> 
> 
> On Nov 10, 2014 3:30 PM, "Martin Thomson" <[e-mail] <mailto:[e-mail]>> wrote:
> >
> > On 10 November 2014 14:23, Daniel Kahn Gillmor <[e-mail] <mailto:[e-mail]>> wrote:
> > > i agree that X.509 is a disaster here, but i think making up a new
> > > delegation protocol won't necessarily be a non-disaster -- we could
> > > instead just rehash some of the sharp bits of the X.509 mess
> > > (revocation, duration, transparency, identity, etc) in a different
> > > format if we're not clear about what we're doing :/
> >
> > Prior to the discussion yesterday, I was really warming to this idea.
> > After it, particularly the discussion around the creation of a
> > delegation point, I think that I've been convinced that we shouldn't
> > do this.
> 
> Every 0-RTT solution involves a similar delegation, as the client is using data sent from the server in the prevoius interaction or OOB to encrypt the early data.
> 
> What exactly was the problem mentioned at the meeting?
> 
> 

The issue is that the server sends a certificate + a buffer that is a long-term DH public key signed with the private key associated with the public key in that certificate. 

Anyone who has that certificate and buffer plus the long-term DH private key can impersonate the server. It’s delegation in the sense that the server can sign a DH public key and let another node impersonate it. 

So the argument against it is that the new signed buffer is in effect a credential, a certificate. Except that this kind of certificate does not have the PKIX stuff. Specifically, there is no revocation for that signature. A compromised signed  DH public key can only be revoked by revoking the certificate.   As we are not currently prepared to work on TLS delegation, we don’t want to sneak delegation in through the back door.

It should be noted that CloudFlare manages to make delegation work ([1]) even without changing the protocol, but I wonder a little about that solution. Isn’t the latency horrible? How secure is the connection between CloudFlare and the customer? Does it create a sign-everything service?

Yoav

[1] http://blog.cloudflare.com/keyless-ssl-the-nitty-gritty-technical-details/