[TLS] RFC 4492 and HSM

[Watson Ladd <[e-mail]>]

Dear all,
RFC 4492 specifies an ECDSA signature of the server's curve parameters
and ephemeral point, but not any fresh data. As a result the ephemeral
exponent is equal in sensitivity to the long-term exponent of the
ECDSA key, forcing an HSM to protect both, and thus do three
exponentiations per connection.

If an HSM has limited signing power compared to the CPU of the machine
it is attached to this is a real limitation. An extra layer of
indirection, in which a time limited key is signed by the certificate,
avoids this issue, but is not currently supported if I'm reading
everything correctly. Triple-DH handshakes partially mitigate this
issue, reducing the online impact to one exponentiation per
connection.

If this wrinkle doesn't get ironed out I'm not terribly unhappy. But
if we are going to do major surgery on the PRF and related things, the
ECDHE handshake is exposed anyway.

Sincerely,
Watson Ladd