Re: [TLS] OPTLS: Signature-less TLS 1.3

[Nico Williams <[e-mail]>]

On Mon, Nov 10, 2014 at 02:08:06PM -1000, Yoav Nir wrote:
> It should be noted that CloudFlare manages to make delegation work
> ([1]) even without changing the protocol, but I wonder a little about
> that solution. Isn't the latency horrible? [...]

Session resumption makes up for it, amortizing the impact on the user.

It's probably no worse (typically) than 2 or 3x the normal latency, for
the first connection (or first handful of concurrent connections).  It'd
be interesting to see how noticeable this is, but I suspect that on the
whole it's not really all that noticeable.

>                                      [...] How secure is the
> connection between CloudFlare and the customer? [...]

In principle it should be no less secure than TLS itself.  (I've not
looked closely enough, but I imagine that's exactly what CloudFlare uses
for their connection to their customers' key sign server.)

>                                           [...] Does it create a
> sign-everything service?

Yes, which is why you need to get authentication (of CloudFlare to the
key server) right, so you can authorize key sign requests.  And the
customer should be doing this with server names and certs and keys that
are only for the CloudFlare use anyways.

This brilliantly lets CloudFlare out of the business of having certs
with lots of names, and it simplifies key management for their
customers.  The price is that this requires SNI.

> [1] http://blog.cloudflare.com/keyless-ssl-the-nitty-gritty-technical-details/


Nico
--