Subject: Re: [TLS] A la carte handshake negotiation

From: Dave Garrett <[email-masked]>
Date: Tue, 16 Jun 2015 15:59:44 -0400

There's enough arguments in this thread and the ChaChaPoly thread that anon suites are not the best way to do things. I've cut it from the draft proposal and relegated it to its own section. This would have (EC)DH_anon suites deprecated for TLS 1.3 in favor of raw keys (RFC7250; trust on first use) or (EC)DHE PSK with the identity "anonymous" universally reserved to have a NULL PSK key. (PSK spec wants printable characters for identities) Getting rid of the separate anon suites simplifies things significantly and should be better for its use-cases. New ECDH_anon suites aren't needed anymore, as ECDHE_PSK will suffice. (though, I think ChaChaPoly should probably specify an ECDH_anon suite for TLS 1.2 in the meantime)

https://github.com/davegarrett/tls13-spec/blob/alacarte/draft-ietf-tls-tls13.md#cipher-suites-in-tls-13
https://github.com/davegarrett/tls13-spec/blob/alacarte/draft-ietf-tls-tls13.md#anonymous-key-exchange

There's a little hand-waving in the new anon bit as the PSK side of TLS 1.3 is currently a WIP as-is. (the new method of offering a PSK id is not yet specified, but in WIP)

This draft keeps certificate authenticated suites and PSK suites separate. Attempting to merge everything into one prefix does not appear to be worth the trouble.

Dave