Subject: [TLS] I-D: TLS += Kerberos (provides Quantum Relief for DH)

From: Rick van Rein <[email-masked]>
Date: Tue, 25 Feb 2020 08:32:48 +0100

Hello,

We have prepared the following draft, and request feedback on it.  The
main points are

 * Introduction of (anonymous) Kerberos tickets as added entropy to mix
with ECDH, and thereby provide Quantum Relief; it generalises this idea
to allow for other ways of adding entropy
 * Introduction of Kerberos Tickets for Certificate and
CertificateVerify messages
 * User identity on the server side; how TLS can be relayed to a peer,
which Kerberos can handle with its user-to-user authentication
mechanism; it generalises this idea, and perhaps it might be better as a
separate TLS Extension under ClientHello encryption.
 * Everything applies to TLS 1.3 as well as 1.2.

Our intention is to launch this as an independent proposal.

Your insights are highly appreciated!

Best,

Rick van Rein
Tom Vrancken

A new version of I-D, draft-vanrein-tls-kdh-06.txt
has been successfully submitted by Rick van Rein and posted to the
IETF repository.

Name:		draft-vanrein-tls-kdh
Revision:	06
Title:		Quantum Relief with TLS and Kerberos
Document date:	2020-01-22
Group:		Individual Submission
Pages:		19
URL:
https://www.ietf.org/internet-drafts/draft-vanrein-tls-kdh-06.txt
Status:         https://datatracker.ietf.org/doc/draft-vanrein-tls-kdh/
Htmlized:       https://tools.ietf.org/html/draft-vanrein-tls-kdh-06
Htmlized:       https://datatracker.ietf.org/doc/html/draft-vanrein-tls-kdh
Diff:           https://www.ietf.org/rfcdiff?url2=draft-vanrein-tls-kdh-06

Abstract:
   This specification describes a mechanism to use Kerberos
   authentication within the TLS protocol.  This gives users of TLS a
   strong alternative to classic PKI-based authentication, and at the
   same introduces a way to insert entropy into TLS' key schedule such
   that the resulting protocol becomes resistant against attacks from
   quantum computers.  We call this Quantum Relief, and specify it as
   part of a more general framework to make it easier for other
   technologies to achieve similar benefits.

---

From: "Salz, Rich" <[email-masked]>
Date: Tue, 25 Feb 2020 16:25:04 +0000

Have you seen https://datatracker.ietf.org/doc/draft-irtf-cfrg-randomness-improvements/ ?

---

From: Nico Williams <[email-masked]>
Date: Tue, 25 Feb 2020 13:15:20 -0600

> to allow for other ways of adding entropy

I don't believe that using Kerberos helps on the _entropy_ side as much
as on the PQ side.

Specifically, Needham-Schroeder is PQ provided you're using a PQ cipher,
which AES-256 essentially is.  Kerberos being based on
Needhamr-Shcroeder...

Now, the biggest problem with Kerberos is that with manually-keyed
cross-realm trusts doesn't scale to Internet scale.  But there's a way
to fix that too: use PQ PK with PKINIT as a form of "PKCROSS", and now
Kerberos can function as a way of amortizing PQ PK costs.

> CertificateVerify messages

Kerberos tickets and AP-REQs could be used as session resumption
tickets.  That only works for TLS 1.3, but I'm OK with that.

Nico
--

---

From: Rick van Rein <[email-masked]>
Date: Tue, 25 Feb 2020 20:30:21 +0100

Hi Rich,

> Have you seen https://datatracker.ietf.org/doc/draft-irtf-cfrg-randomness-improvements/ ?

I hadn't.  Are you suggesting to insert the session key, or anything derived from it, into this CPRNG-alternative mechanism?

The spec speaks of ways of communicating entropy, not necessarily having them available on two ends yet.  That's a mild generalistion over the idea of passing a Kerberos ticket, which is essentially the pupose of this proposal.  I am however listening here if the generalisation is useful.  (I do have a few immature ideas that could use it.)

-Rick

---

From: "Salz, Rich" <[email-masked]>
Date: Tue, 25 Feb 2020 19:36:11 +0000

I'm not suggesting anything, just pointing out some possibly-related work. :)

---

From: Rick van Rein <[email-masked]>
Date: Wed, 26 Feb 2020 10:40:44 +0100

Hello Nico,

> I don't believe that using Kerberos helps on the _entropy_ side as much

Ah; I meant to (be terse and) say that it adds an independent source of entropy that leaves no traces in the TLS flow subject to, indeed, Quantum Computer cracking.

> Kerberos can function as a way of amortizing PQ PK costs.

Indeed :- though I'd have mentioned KXOVER or Kerberos Realm Crossover,
https://gitlab.com/arpa2/kxover
This is founded on DNSSEC, DANE and TLS.

Thanks,
 -Rick