Re: [TLS] Thoughts on TLS 1.3 cryptography performance

[Trevor Perrin <[e-mail]>]

On Thu, Mar 13, 2014 at 10:29 AM, Watson Ladd <[e-mail]> wrote:

> On Thu, Mar 13, 2014 at 9:52 AM, Nico Williams <[e-mail]>
> wrote:
> > On Thu, Mar 13, 2014 at 11:48 AM, Eric Rescorla <[e-mail]> wrote:
> >> On Thu, Mar 13, 2014 at 9:34 AM, Nico Williams <[e-mail]>
> >> wrote:
> >>>
> >>>  But I am concerned about the need for PFS on
> >>> resumption in order to limit the extent of resumption ticket cache
> >>> compromise; if you're going to lose the 0-RTT resumption for it, might
> >>> as well pick the best "fast reauthentication" protocol possible, and
> >>> that might be Watson's.
> >>
> >>
> >> WRT this specific point, I wanted to observe that computational cost
> >> (within reason) is less important than round trip delay, for a number of
> >> reasons:
> >
> > My concern is in the sense of "this needs to be a security
> > consideration, and Watson's protocol is worth considering at least as
> > an option" (modulo IPR, if any).
>
> Triple DH is unpatented AFAIK. MQV patent expires soon


It's a little more complex than this.

I think HMQV has a patent from IBM as well as the Certicom MQV patents.

Triple DH itself is unpatented and derives from [1,2].  But when hashing
identity information into the session key, Microsoft's KEA+ patent (which
covers doing this with a "Double DH") might possibly be viewed as relevant.

(I think that's an obvious combination of prior art, and arguably not
directly relevant.  But it creates some uncertainty.)


Trevor


[1] http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.27.8493
[2] http://www.iacr.org/cryptodb/archive/2005/ASIACRYPT/283/283.pdf