Re: [TLS] Non-TLS opportunistic encryption

[Tom Ritter <[e-mail]>]

On 19 July 2014 11:28, Phillip Hallam-Baker <[e-mail]> wrote:
> If we are going to insist on 'encryption everywhere' and accept
> opportunistic encryption then all we need is a D-H key agreement and
> some mechanism for applying encryption to packets.
>
> The result might be TLS-Lite, a very minimal subset of TLS or it might
> be a completely different protocol. But the key thing would be to keep
> it separate from TLS so that ubiquitous best effort TLS does not end
> up weakening regular TLS.

It's not clear to me exactly what you mean by 'weakening regular TLS'
- I'd also disagree that opportunistic encryption should get any of
the UI indicators that TLS gets.

I'm not sure if Opportunistic TLS is still on-topic for this list, but
the primary concern I've seen people put forward (and agree with)
about Unauthenticated Ciphersuites or a DH handshake is that with
self-signed certs - you can build a Convergence-style in-line
authenticity system or a CT-style after-the-fact detection system on
top of it.

With the other options, you lose that capability.  And if you try and
shoe-horn a long-lived signing key on top of that, you've reinvented
some subset of TLS+PKIX - why not just use that subset and not require
any (significant) server code changes.

-tom