[TLS] How to reduce number of verifications

[Watson Ladd <[e-mail]>]

Dear all,

Right now it looks like browsers will need to conduct a lot of
signature verifications. First, they will need to verify the
certificate chain. Second, they will need to validate OCSP. Thirdly,
they will need to validate CT records, when Certificate Transparency
is deployed.

Most of these signatures are not online. All of them can safely be
done with currently deployed RSA 2048, or a 255 bit elliptic curve.
None of them require more security, as future cryptanalysis cannot
affect today's authentication.

We should consider carefully studying which combinations of algorithms
for which signatures will provide the most performance, as well as how
we can minimize the number of verifications that will take place. I've
not done that much in this direction: it comes down to the marginal
cost of batch verification of Schnorr-like schemes vs. straight RSA
verification when we don't have online signing.

Sincerely,
Watson Ladd