Re: [TLS] OPTLS: Signature-less TLS 1.3

On Nov 10, 2014 3:30 PM, "Martin Thomson" <martin.thomson@gmail.com> wrote:
>
> On 10 November 2014 14:23, Daniel Kahn Gillmor <dkg@fifthhorseman.net>
wrote:
> > i agree that X.509 is a disaster here, but i think making up a new
> > delegation protocol won't necessarily be a non-disaster -- we could
> > instead just rehash some of the sharp bits of the X.509 mess
> > (revocation, duration, transparency, identity, etc) in a different
> > format if we're not clear about what we're doing :/
>
> Prior to the discussion yesterday, I was really warming to this idea.
> After it, particularly the discussion around the creation of a
> delegation point, I think that I've been convinced that we shouldn't
> do this.

Every 0-RTT solution involves a similar delegation, as the client is using
data sent from the server in the prevoius interaction or OOB to encrypt the
early data.

What exactly was the problem mentioned at the meeting?

>
> Aside fro the delegation advantage, the real benefits of this are
> largely seen in the short term for RSA certificates.  Moving to ECDSA
> obviates one of the big performance advantages, and the concerns
> around getting delegation right make me now against pursuing this.
>
> I don't think that this is categorically bad, or that we should not do
> this ever, but it's a big change and one that is much harder to get
> right than I originally thought.

So what is the alternative exactly? Is it hacking 0-RTT and 1-RTT modes
onto TLS 1.2 and hoping miTLS fixes the mistakes?

ECDSA only obviates the performance advantage for genus 1. For genus 2 is a
different story. Furthermore,  eliminating online certificates enables
isolation of certs without a performance penalty.

>
> _______________________________________________
> TLS mailing list
> TLS@ietf.org
> https://www.ietf.org/mailman/listinfo/tls