Re: [TLS] Should we support static RSA in TLS 1.3?

[Manuel Pégourié-Gonnard <[e-mail]>]

On 17/11/2013 01:47, Eric Rescorla wrote:
> This isn't a no-brainer, though. Static RSA is still by far the
> dominant key exchange algorithm and if you have an RSA certificate, is
> strictly faster than any ephemeral suite.

Yes, if you have an RSA certificate. OTOH, if in the coming years ECDSA
certificates become more popular, then ECDHE_ECDSA is less computationally
expensive for the server than static RSA, though more expensive for the client.

(By the way, having key exchanges that are less expensive for the server is also
good to make DOS attacks harder.)

> There are also some settings where PFS is actually undesirable,
> especially for diagnosis and monitoring. In this settings, it's much
> more convenient to simply provide the monitoring device with the
> server key. ssldump and wireshark, for instance, both provide this
> feature.
> 
I don't know about ssldump, but with wireshark if you're interested in debugging
only a handful of sessions, it can directly use the premaster secret if you can
get your SSL library to display it (I know NSS can do it, I don't know if
OpenSSL can).

Also, it is possible to (temporarily) use static keys with a
supposedly-ephemeral (EC)DH key exchange and an option could be added to
wireshark and similar tools to take advantage of that.


Overall, I'd be inclined to drop static RSA key exchange in TLS 1.3 and allow
only ephemeral key exchanges (except maybe for the PSK key exchanges).

Manuel.