Re: [TLS] OPTLS: Signature-less TLS 1.3

[Daniel Kahn Gillmor <[e-mail]>]

On Fri 2014-11-07 01:21:26 -0500, Andy Lutomirski wrote:

> If I buy a cert for *.my.domain, I want to be able to provision
> foo.my.domain with some secret that lets it act as foo.my.domain but
> not bar.my.domain.  Since the PKIX people seem to be completely unable
> to address this, pinning DH shares to a domain would solve the problem
> without involving any PKIX changes.

If we could provide this, it could be a very interesting operational win
in the context of expensive/cumbersome CAs and medium-sized
organizations with many services (internal and external).

It would effectively allow a wildcard cert for a given domain to act as
a domain-constained sub-CA, without getting into the X.509 weeds about
domain constraints.  The secret key material corresponding to the
wildcard cert could be kept offline, and used to issue medium-term DH
shares that are distributed to each service.

Unfortunately, i don't see a way to deploy this effectively without
putting the secret key material associated with the wildcard cert online
for each service that needs to support legacy clients, which would make
the security advantage moot.

    --dkg