Re: [TLS] OPTLS: Signature-less TLS 1.3

[Nico Williams <[e-mail]>]

On Tue, Nov 11, 2014 at 09:47:23AM -1000, Yoav Nir wrote:
> > On Nov 11, 2014, at 7:33 AM, Nico Williams <[e-mail]> wrote:
> > That the "sub-cert" needs either a revocation scheme (not likely) or a
> > short lifetime.  The latter puts this on a par with session resumption,
> > thus making one (well, me) wonder what the advantage to the static DH
> > concept would be.
> 
> There is a revocation scheme. If the private ECDH key is lost, you
> revoke the certificate, thereby invalidating the delegation.

Ah, good point!

> > We could put static DH keys in DNSSEC and learn them that way, which
> > would get us 0rt.
> 
> Another possibility is to place the ECDH public key in a certificate
> extension. This gives it a lifetime as long as the certificate, and it
> doesn’t matter whether the “regular” certificate public key is RSA or
> ECDSA or anything else. 

Sure, certs could have multiple subject public keys.  That'd be a very
nice.  A cert could have an encryption key, a different signature key,
and a key agreement key.

> It removes the need to use signatures at all by the server. Not even
> once.

Yes.  I like this.

Nico
--