Subject: [TLS] TLS handshake performance (was Re: Confirming Consensus on removing RSA key Transport from TLS 1.3<)

From: Watson Ladd <[email-masked]>
Date: Wed, 26 Mar 2014 20:01:15 -0400

On Wed, Mar 26, 2014 at 7:28 PM, Martin Rex <[email-masked]> wrote:
> Watson Ladd wrote:
>>>
>>> If RSA was weak, _any_single_use_ of RSA would make you "vulnerable",
>>> not just the RSA encryption of the premaster secret, but in just the
>>> same fashion the RSA signature on the (EC)DHE parameter in the
>>> ServerKeyExchange handshake message.  Or the signatures on the
>>> certificate chain, or the signatures on the OCSP responses or CRLs.
>>
>> RSA signatures in the PKI are being increased in size to 2048 and 4096
>> over the next few years to address this problem. This doesn't seem to
>> be in the cards for static RSA because of the speed issues.
>>
>> Furthermore, this is orthogonal to the issue of the fastest TLS
>> handshake. RSA decryption is very slow, so you can do the two
>> exponentiations to complete a P256 handshake and signing in the time
>> to encrypt. The client doesn't matter: it is making very few
>> connections, so can take a while to do the calculations.
>
> When using an RSA server certificate the server can choose between having
> to perform static RSA key exchange with an RSA private key (decryption)
> operation on the RSA PremasterSecret or an RSA Private key (signature)
> operation to sign the ServerKeyExchange handshake message
> --and that signature covers ClientHello.random and ServerHello.random
> so is unique per full handshake, just like the RSA decryption of the
> Premaster secret.
>
> Where exactly do you see a performance _advantage_ of an RSA-signed
> (EC)DHE key exchange vs. an RSA-decrypted PremasterSecret?

Not RSA signed, but ECDSA signed. Three exponentiations vs. one RSA
private key operation.  Using openssl speed I got that ECDH+ECDSA is
twice as fast as RSA.

If you are stuck with an RSA server key, you can use a semistatic
ECDSA key, and do exactly one exponentiation per connection,
plus one RSA private key operation per key rotation interval. There is
a reason large sites use ECDHE-ECDSA.

If I remember correctly, switching the key the server uses for clients
doesn't require a new certificate, but I might be wrong.

Sincerely,
Watson Ladd

> -Martin

-- 
"Those who would give up Essential Liberty to purchase a little
Temporary Safety deserve neither  Liberty nor Safety."
-- Benjamin Franklin