Re: [TLS] Clarifications and questions: TLS1.3 - Static RSA and AEAD

[Dan Brown <[e-mail]>]

> -----Original Message-----
> From: TLS [mailto:[e-mail]] On Behalf Of Blumenthal, Uri - 
> 0558 -
> MITLL
> Sent: Tuesday, May 27, 2014 9:44 AM
>
> >...... Could someone confirm
> >"removing static RSA" results in removing the use of  RSA as a key
> >transport mechanism from 1.3 (e.g. as defined in section 7.4.7.1 of
> >TLS1.2 - basically removing this section and prohibiting "rsa" and
> >"rsa_psk"  as key exchange algorithms)?
> >
> >To go further and take this up from specific cryptography - will/should
> >TLS 1.3 prohibit *any* Key Transport mechanism and retain only Key
> >Agreement mechanisms for key exchange?
>
> What would be the consequences of this decision for embedded servers that
> may not have a good source of randomness to meaningfully engage in
> [EC]DH[E]?


As noted elsewhere, if the server is authenticated (or at least has a 
long-term private key) and has a persistent state then it should be able to 
implement a good PRNG.  Then it can do pretty good DHE, with forward secrecy, 
which is better than key transport.

Otherwise, static [ECH]DH seems quite similar in security properties to key 
transport, from the server's side, for the following 2 reasons.

If the server is completely stateless and lacks an entropy source, it will 
fail to achieve FS in its attempts at DH[E], but this is still as good as key 
transport.

If the server is anonymous, (or at least lacks a long-term private key) and 
lacks a source of entropy, a persistent state does not seem to help, whether 
for DH or RSA key exchanged.

---

A different question:  what about very constrained clients?  Is this even a 
fair question?

For example, what if the client can be seeded with entropy but lacks a live 
entropy source and a persistent state (to implement a good PRNG)?

Currently key transport require the client to generate a random 
pre_master_secret.  A weak client could naively always generate the same PMS, 
which would be bad.  It could derive the PMS from the server key public key, 
and perhaps the server random value, so that PMS is not common to two 
different servers, or sessions.  This would make it similar to static DH.

An even weaker client is one that is unseeded and entropy-lacking (and 
completely stateless, not that statefulness would help here).   Such a client 
could apply deterministic encryption of messages using RSA.  Note that this 
would no longer be key transport, but rather content encryption, so would 
require a major change to TLS. Also, this type of deterministic encryption 
lacks many of the important security benefits of probabilistic encryption. 
There have been research papers about deterministic encryption: the security 
is limited by the amount of entropy in the message being encrypted.  Anyway, 
maybe this is the one situation in which RSA has an advantage over DH.