Re: [TLS] A la carte handshake negotiation

[Eric Rescorla <[e-mail]>]

On Sat, Jun 13, 2015 at 9:15 PM, Dave Garrett <[e-mail]>
wrote:

> On Saturday, June 13, 2015 08:54:10 pm Eric Rescorla wrote:
> > On Sat, Jun 13, 2015 at 8:44 PM, Dave Garrett <[e-mail]>
> > wrote:
> > > PSK suites could be replaced with a PSK SignatureAlgorithm codepoint in
> > > “signature_algorithms” extension. (this was suggested by someone at
> some
> > > point on this list, but I don't remember where that discussion was,
> offhand
> >
> > I don't see how this is going to work. All of the PSK cipher suites use
> the
> > PSK as a source of keying material
>
> A client proposing the PSK SignatureAlgorithm codepoint and a PSK identity
> would be offering to negotiate PSK using that key.
>

But again, PSKs in TLS use it as a source of keying material, not just
authentication. So, using that as a SignatureAlgorithm seems... weird.

-Ekr

Anon would be proposed the same way, just with a null PSK identity. All
> security comes from the FS from (EC)DHE. (just like (EC)DH_anon)
>
> The server could simply state acceptance of negotiation by echoing back
> the same PSK extension.
>
> > > With the above, ECDHE_ECDSA becomes the one-true-prefix.
> >
> > Maybe I'm misunderstanding what you're saying here, but I don't
> understand
> > this point. Certainly I don't see any significant support whatsoever for
> > deprecating RSA signatures, and given that we just standardized FFDHE, I
> don't see much
> > evidence of consensus for deprecating DHE either.
>
> This is all in the context of the proposal discussed in this thread. RSA
> signatures would be negotiated using the "signatures_algorithms" extension.
> DHE would be negotiated via the "named_groups" extension. (pick an FFDH
> group for FFDHE or an ECDH curve for ECDHE) The point is to negotiate any
> of the following via those two extensions and the ECDHE_ECDSA prefix:
> DHE, ECDHE, RSA, DSS/DSA, ECDSA (or EdDSA), PSK (or anon)
>
> This would give us fewer suites with no new extensions beyond those
> already proposed. Just need to use the already proposed extension additions
> and add a codepoint for PSK/anon.
>
>
> Dave
>