Re: [TLS] OPTLS: Signature-less TLS 1.3

[Daniel Kahn Gillmor <[e-mail]>]

On 11/10/2014 01:45 PM, Watson Ladd wrote:
> Furthermore,  eliminating online certificates enables
> isolation of certs without a performance penalty.

if we get people to move their secret keys offline by replacing certs
with something that is cert-equivalent for purposes of authentication,
then what have we gained?

The reason to move secret keys offline is to protect the identity
credentials of the TLS endpoint, not because those keys are valuable in
themselves.  If a delegation process creates a new object that is an
identity credential for the TLS endpoint, and the secret part of that
object remains online, we haven't actually gained anything.

Note: we *could* gain something, of course, if we manage to clearly and
effectively scope the utility of the delegated credential more narrowly
than the parent credential; then moving the wider-scoped parent
credential's secrets offline is indeed a win.

But it's not clear how to do that kind of scoped delegation correctly --
or even what forms of scoped delegation are desirable -- do we want to
narrow the scope by time?  by identity?  by network address?  by protocol?

If someone wants to work on delegation in its own right, i think that
could be useful.  But adopting delegation "by accident" while we're
defining a new key exchange mechanism seems likely to get us into worse
trouble down the road.

	--dkg