[TLS] Thoughts on draft-rescorla-tls13-semistatic-dh-00

[Watson Ladd <[e-mail]>]

Dear all,

I read the draft and have a few comments. First off it seems like
OPTLS used an HKDF extracted key to feed into the content keys,
instead of reusing the shared secret. I'm pretty sure that will end up
not mattering, but I'm by no means an expert in how much some change
like that will affect the analysis.

Secondly there is the question of performance. A fixed based
exponentiation can almost always be done faster then a variable base
exponentiation because it offers precomputation. As specified a server
does one fixed based exponentiation and two variable based
exponentiations, while with signatures a server does two fixed based
exponentiations and one variable base exponentiation. The performance
gains possible from OPTLS come from reuse of the ephemeral, resulting
in just two variable base exponentiations for most clients, unless
there is a very fast choice of group that doesn't support signatures
out there. The given example of x25519 vs. P256 could be solved with
issuing an Ed25519 delegated credential for instance. Clients will see
a performance gain if the total number of signature verifications goes
down as two variable base exponentiations are cheaper then a
verification plus variable base exponentiation, but that depends on
not using delegated credentials.

Perhaps more interesting is the question of postquantum schemes that
don't support signatures.  But there a classical signature usually
outperforms a postquantum key exchange, and so it is not very
interesting to do two postquantum key exchanges instead of one and a
classical signature.

As for client authentication I think the server ephemeral+client
static producing a key they use to MAC works out: it's no worse for
mixing the client secret in then the signature based client
authentication is in TLS.

Sincerely,
Watson Ladd