Re: [TLS] Thoughts on TLS 1.3 cryptography performance

On Thu, Mar 13, 2014 at 9:52 AM, Nico Williams <nico@cryptonector.com> wrote:
> On Thu, Mar 13, 2014 at 11:48 AM, Eric Rescorla <ekr@rtfm.com> wrote:
>> On Thu, Mar 13, 2014 at 9:34 AM, Nico Williams <nico@cryptonector.com>
>> wrote:
>>>
>>>  But I am concerned about the need for PFS on
>>> resumption in order to limit the extent of resumption ticket cache
>>> compromise; if you're going to lose the 0-RTT resumption for it, might
>>> as well pick the best "fast reauthentication" protocol possible, and
>>> that might be Watson's.
>>
>>
>> WRT this specific point, I wanted to observe that computational cost
>> (within reason) is less important than round trip delay, for a number of
>> reasons:
>
> My concern is in the sense of "this needs to be a security
> consideration, and Watson's protocol is worth considering at least as
> an option" (modulo IPR, if any).

Triple DH is unpatented AFAIK. MQV patent expires soon, but I don't
like it. With Triple DH we can use genus 2 for even more speed, and
when Kim Laine finishes his PhD, genus 3. Genus 3 is amazing because
the arithmetic is modulo a 64 bit prime. We can't do higher genus
stuff+MQV because of the lack of an addition formula on the compact
forms.

Sincerely,
Watson Ladd
>
> Nico
> --
>
> _______________________________________________
> TLS mailing list
> TLS@ietf.org
> https://www.ietf.org/mailman/listinfo/tls

-- 
"Those who would give up Essential Liberty to purchase a little
Temporary Safety deserve neither  Liberty nor Safety."
-- Benjamin Franklin