Re: [TLS] Confirming Consensus on removing RSA key Transport from TLS 1.3

[Eric Rescorla <[e-mail]>]

You're probably thinking of:
http://tools.ietf.org/html/draft-gillmor-tls-negotiated-dl-dhe-02

This seems like a reasonable kind of thing for the WG to
consider, but my impression was that the WG consensus
was to remove static RSA unconditionally. Certainly, it would
be reasonable to argue that we should address this issue prior
to final publication, however.

-Ekr



On Mon, May 5, 2014 at 10:00 AM, Kurt Roeckx <[e-mail]> wrote:

> On Mon, May 05, 2014 at 09:28:23AM +0200, Nikos Mavrogiannopoulos wrote:
> > On Sat, 2014-05-03 at 16:31 -0700, Eric Rescorla wrote:
> > > The following pull request is intended to execute this change:
> > >
> > > https://github.com/tlswg/tls13-spec/pull/37
> > > I'll merge it in on Tuesday. Please let me know before then if
> > > this seems substantially wrong. As usual, minor editorial issues
> > > can be done by pull requests.
> >
> > Shouldn't such a change depend on a fix to the compatibility issues
> > present in the DHE ciphersuites? Otherwise it just makes ECDHE the only
> > key exchange in TLS that can be made compatible with random peers.
> >
> > Elliptic curves are good, but it would be nice to have non-ECC key
> > exchanges as well.
>
> I was under the impression that there was also a proposal to use
> known DHE primes so that there is no requirment to verify them.
>
> I'm not sure this is written down somewhere, but I think that we
> only want to use things where the verification is very simple.
>
>
> Kurt
>
>