IETF Logo Mail Archive

Re: [TLS] Drafts for batch signing and PKCS#1 v1.5

David Benjamin <davidben@chromium.org> Tue, 30 July 2019 19:09 UTC

Return-Path: <davidben@google.com>
X-Original-To: tls@ietfa.amsl.com
Delivered-To: tls@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 859931201AF for <tls@ietfa.amsl.com>; Tue, 30 Jul 2019 12:09:20 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -9.25
X-Spam-Level:
X-Spam-Status: No, score=-9.25 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HEADER_FROM_DIFFERENT_DOMAINS=0.249, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_SPF_WL=-7.5] autolearn=no autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=chromium.org
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 6YZZTvZ8wZPL for <tls@ietfa.amsl.com>; Tue, 30 Jul 2019 12:09:19 -0700 (PDT)
Received: from mail-qk1-x733.google.com (mail-qk1-x733.google.com [IPv6:2607:f8b0:4864:20::733]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DC6DD12010F for <tls@ietf.org>; Tue, 30 Jul 2019 12:09:18 -0700 (PDT)
Received: by mail-qk1-x733.google.com with SMTP id r4so47321311qkm.13 for <tls@ietf.org>; Tue, 30 Jul 2019 12:09:18 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=mime-version:references:in-reply-to:from:date:message-id:subject:to; bh=WmjwWWdP7mD129WUhhz1UHhqAacQClWsZ4JwXaJy8bw=; b=nFK4LH5fyy/5Stm799bcCGq4VVSGTeB/aAiyDi8UA3ZUzgdVVYiUhtAPQF27e4ySNs uI5vVUNGgZr31GP9naeSbaQ/DAZ4pNXLb15+bpOxf7+GU1bkO/7shqUp8j9ZeSkMHAX4 KZgGhhkFIN9tJrDlC1ZRBvBotbk1wmMnp3JOQ=
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to; bh=WmjwWWdP7mD129WUhhz1UHhqAacQClWsZ4JwXaJy8bw=; b=Fn98FlthTC0998Sb/PEuVLtGSADWpQv9jmqMQs/6an67HeUmi2Shmp1CPzhTbEYbqY 8kdTL418g+duVyVMjeyr9O43M3QN2LVVysIa3UL+Yo0dX31ToeEx2zC6l+NN/CQPE8uJ Vgm5YNkvuOQ5WBV+3mfuWcvDwS1V2YQEu2KVfdeyDImJt9sOFDHIHtqWP7Z6MZYmxzwt gD8DHLs5BoqUhqNO8kz2GfxOVUvm6AdGbtysmcVF7MHLPwhrBGL7TQ82N7upCSaAL/Kb PQ6vYHUSHhogbHwC6xOt0v4fxgjC0OCXyVZlWfvSGeDu80TlQUPSqG3pF4Vvfb7nZZxC YhhA==
X-Gm-Message-State: APjAAAWiQWJp5GqWMdLdnMMEbXrYPT0/vU7atx19oDSsiu6KH96CdSyd pLsMwkQm3tjLuv5Q+eJsCUeqEzhf1ccPEj+8Tk3psJYzyA==
X-Google-Smtp-Source: APXvYqxwTXzQymt0okbm6//KhTPe8liDn9dWUYdiD4kF00FgPI+9ZP5NFfty6RHLxBb4s7f5i0Rsbe51YuWUVUqpkIM=
X-Received: by 2002:a37:464a:: with SMTP id t71mr78419476qka.436.1564513757660; Tue, 30 Jul 2019 12:09:17 -0700 (PDT)
MIME-Version: 1.0
References: <CAF8qwaDxRhGXc522Rf4C-8OcGM4Mm08Xca4KNNpHcT=4Va89aA@mail.gmail.com>
In-Reply-To: <CAF8qwaDxRhGXc522Rf4C-8OcGM4Mm08Xca4KNNpHcT=4Va89aA@mail.gmail.com>
From: David Benjamin <davidben@chromium.org>
Date: Tue, 30 Jul 2019 15:09:01 -0400
Message-ID: <CAF8qwaD=5B9AXkGziwHZ-=LGH-n6fW0KQ9cQfZ2DWhpjDujhEQ@mail.gmail.com>
To: "<tls@ietf.org>" <tls@ietf.org>
Content-Type: multipart/alternative; boundary="000000000000c615f8058eeabe32"
Archived-At: <https://mailarchive.ietf.org/arch/msg/tls/qyGSA9Riu92OH5yHnWDEONhB8A8>
Subject: Re: [TLS] Drafts for batch signing and PKCS#1 v1.5
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/tls/>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 30 Jul 2019 19:09:21 -0000

Oops. draft-davidben-tls-batch-signing-00 cites
draft-davidben-http2-tls13-00. That should be
draft-davidben-tls13-pkcs1-00. (The XML file took a really long time to be
created, so I manually tried to recreate it based on another file and
forgot to update one of the fields.) I'll fix this in -01.

On Mon, Jul 29, 2019 at 8:15 PM David Benjamin <davidben@chromium.org>
wrote:

> Hi all,
>
> I’ve just uploaded a pair of drafts relating to signatures in TLS 1.3.
> https://tools.ietf.org/html/draft-davidben-tls13-pkcs1-00
> https://tools.ietf.org/html/draft-davidben-tls-batch-signing-00
>
> The first introduces optional legacy codepoints for PKCS#1 v1.5 signatures
> with client certificates. This is unfortunate, but I think we should do it.
> On the Chrome side, we’ve encountered some headaches with the TLS 1.3 PSS
> requirement which are unique to client certificates. The document describes
> the motivations in detail.
>
> The second describes a batch signing mechanism for TLS using Merkle trees.
> It allows TLS clients and servers to better handle signing load. I think it
> could be beneficial for a number of DoS and remote key scenarios.
>
> Thoughts?
>
> David
>

v2.23.0 | Report a Bug | By Email