Re: [TLS] OPTLS: Signature-less TLS 1.3

[Yoav Nir <[e-mail]>]

> On Nov 10, 2014, at 2:52 PM, Nico Williams <[e-mail]> wrote:
> 
>> The reason to move secret keys offline is to protect the identity
>> credentials of the TLS endpoint, not because those keys are valuable in
>> themselves.  If a delegation process creates a new object that is an
>> identity credential for the TLS endpoint, and the secret part of that
>> object remains online, we haven't actually gained anything.
> 
> The delegation has to have a short lifetime because otherwise it
> might as well be a certificate issued by an intermediate CA...
> 
> ...which the customer can't get because of the failure to widely
> implement and deploy PKIX name constraints.
> 
> But also because of revocation: if you have to check the status of the
> key then you lose the 0rt.
> 
> By putting a short lifetime on the delegation that problem goes away.
> But then there's no advantage over plain session resumption.

How short is “short”? This is yet another thing that is hosed by the non-availability of a secure time signal. Clocks are skewed, so if you use a notAfter date that is less than 24 hours away, you’re going to have clients thinking that this has already passed. 

Sure, we MUST fix time. But we also MUST fix PKIX name constraints, and I think we’re close to solving the latter than we are to solving the former.

> Even if each 0rt connection can lengthen the delegatee key's life by
> having the server send a fresh signature of the key as needed, the
> server could also just refresh the session resumption state/ticket.
> 
> IMO the main value in static DH is in learning the server's static DH
> pubkey out of band, via DNSSEC (DANE).  That eliminates all these
> concerns while enabling 0rt connections _every_ time for servers that
> have such keys.

This assumes a deployed DNSSEC. That will happen some time after the secure time signal.

> Of course, 0rt connections can't provide proper PFS to data sent
> immediately after the client's first TLS handshake message.  That's a
> problem, no?

I guess you can’t have everything. 

Yoav