Re: [TLS] OPTLS: Signature-less TLS 1.3

[Eric Rescorla <[e-mail]>]

On Sun, Nov 2, 2014 at 2:24 PM, Hugo Krawczyk <[e-mail]>
wrote:

>
>
> On Sat, Nov 1, 2014 at 7:15 AM, Watson Ladd <[e-mail]> wrote:
>
>> Dear Hugo,
>>
>> There are some issues I can see:
>>
>> -Servers already supporting ECDSA certificates seem to not win. If I'm
>> understanding correctly, a server does three exponentiations, one of
>> which can be optimized by ephemeral reuse, when using ECDSA+ECDHE. The
>> servers that win are the ones with RSA certs. The only way to win vs
>> ECDSA is if DH only permits faster exponentiation, which it does, and
>> removing the ancillary junk in ECDSA.  However, here we have two
>> variable base exponentiations after ephemeral reuse, as opposed to one
>> fixed, one variable, so there is a loss in performance on the same
>> group, made up for by removing inversions modulo the group order.
>>
>
> ​Don't forget that 0-RTT cannot be supported with a signature-based
> protocol
>

I'm not sure that this is correct. If a client does a 1-RTT exchange first
(which he will have to do if he is naive about the server) then the
server can provide a semi-static DH key for future use at that time
and use a signature over the entire transcript to authenticate it, no?

-Ekr