Re: [TLS] Rethink TLS 1.3

[Henrick Hellström <[e-mail]>]

On 2014-11-22 01:57, Watson Ladd wrote:
> Was the TLS 1.3 draft written by a cryptographer? No.
> Has it been reviewed by cryptographers? Unclear.
> Are the mechanisms secure? Unknown.
> Is it easy to analyze TLS 1.2? No.
> Was TLS 1.2 secure? No.
> Has TLS 1.3 fixed flaws in TLS 1.2? Some: session_hash remains
> unincluded, but the record layer is finally fixed.

I think such discussions would benefit from the basic premise that 
"secure" is a relative notion. It is completely pointless to ask if a 
protocol is secure or not secure, unless you first present an exhaustive 
list of security claims. That is, you can't ask if TLS 1.3 is secure or 
not, without first describing what security is to be expected from 
different scenarios.

In a sense, *every* protocol has the potential of becoming broken, 
unless it is unambiguously defined what is proper and improper usage of 
the protocol.