Re: [TLS] OPTLS: Signature-less TLS 1.3

[Nico Williams <[e-mail]>]

On Mon, Nov 10, 2014 at 02:15:34PM -1000, Daniel Kahn Gillmor wrote:
> On 11/10/2014 01:45 PM, Watson Ladd wrote:
> > Furthermore,  eliminating online certificates enables
> > isolation of certs without a performance penalty.
> 
> if we get people to move their secret keys offline by replacing certs
> with something that is cert-equivalent for purposes of authentication,
> then what have we gained?

The ability to use cheaper, lower-performance HSMs, for one (maaaybe,
and only where one was using an HSM to begin with).  Or, put another
way, to handle more connections with a given HSM investment.  It's not
nothing.  But see below!

> The reason to move secret keys offline is to protect the identity
> credentials of the TLS endpoint, not because those keys are valuable in
> themselves.  If a delegation process creates a new object that is an
> identity credential for the TLS endpoint, and the secret part of that
> object remains online, we haven't actually gained anything.

The delegation has to have a short lifetime because otherwise it
might as well be a certificate issued by an intermediate CA...

...which the customer can't get because of the failure to widely
implement and deploy PKIX name constraints.

But also because of revocation: if you have to check the status of the
key then you lose the 0rt.

By putting a short lifetime on the delegation that problem goes away.
But then there's no advantage over plain session resumption.

Even if each 0rt connection can lengthen the delegatee key's life by
having the server send a fresh signature of the key as needed, the
server could also just refresh the session resumption state/ticket.

IMO the main value in static DH is in learning the server's static DH
pubkey out of band, via DNSSEC (DANE).  That eliminates all these
concerns while enabling 0rt connections _every_ time for servers that
have such keys.

Of course, 0rt connections can't provide proper PFS to data sent
immediately after the client's first TLS handshake message.  That's a
problem, no?

Nico
--