Re: [TLS] OPTLS: Signature-less TLS 1.3

[Martin Thomson <[e-mail]>]

On 5 November 2014 08:27, Hugo Krawczyk <[e-mail]> wrote:
> The issue of validity period of the static key g^s is not different than
> that of a regular certificate except that the server can choose a shorter
> validity period for g^s than the one for the certificate. That is, if the
> client's clock is skewed by Delta and the validity of g^s is up to time T,
> the client will accept g^s till time T+Delta. Similarly, if the certificate
> expires at time T', the client will accept it until T'+Delta. In either
> case, if T<T' the client will accept g^s for less time than it would accept
> the certificate.
>
> (Needless to say, a client should not accept a signed g^s past the
> expiration date of the certificate signing g^s).
>
> Am I misunderstanding/missing something?

I think that the core concern is that Delta is basically unbounded in
some implementations (see [1]).

To make realistic progress on TLS, I think that we have to consider
this as either basically impossible to fix, or as a problem that will
be solved somewhere else.  That means, that until it is solved, we
should instead acknowledge the problem and move on.  It's a problem
worth solving, but we could waste a lot of time on it.  If someone
solves it, then we can react appropriately at that time.

[1] https://www.blackhat.com/docs/eu-14/materials/eu-14-Selvi-Bypassing-HTTP-Strict-Transport-Security-wp.pdf