Re: [TLS] Deprecating more (DSA?)

[Watson Ladd <[e-mail]>]

Dear all,
I support most of the removal ideas. I would like to note in
particular that 3DES has a 64-bit block, which limits the transferable
data to 2^32 blocks, and so as a backup to AES it is painful. (We
would also need to fix the EtM problem with it: a lot of work that we
don't have to do). I think DHE will fall before ECDHE, but they are
similar enough

ECDSA is a complicated story. Yes, it makes unnecessary use of a
random number generator during signing. It is much safer to add 32
bytes to the secret key, hash that with the message, take that key,
stretch to twice as long as the group order with the hash function.
The inversion of k serves no purpose now that Schnorr's patent has
expired. It cannot be batched.

However, it is still very secure. I would like to see more performant
alternatives develop, but from a security perspective it's fine. FIPS
can do it however they can, and non-FIPS people will do it the right
way. I don't think removal is the right decision at this juncture.

Sincerely,
Watson Ladd