RFC 8773 S3:
> In the near term, this document describes a TLS 1.3 extension to
protect today's communications from the future invention of a
large-scale quantum computer by providing a strong external PSK as an
input to the TLS 1.3 key schedule while preserving the authentication
provided by the existing certificate and digital signature mechanisms.
I don't see anything specifically alarming about the design, but I'm
very uncomfortable about any standards-track document making a strong
security claim like this if its not backed by some kind of formal
analysis.
The document could also be a bit more explicit on the security
properties it achieves and when e.g. that it breaks down once a
large-scale QC is actually available, that clients & servers need to
reject connections which do not negotiate the extension to actually
benefit from its protection.
On the issue of tracking via external PSKs - it's easy to imagine a
scheme where client and server divide time into epochs and derive
per-epoch keys to prevent tracking between epochs. I'm sure there must
be some prior art that could be referenced as a recommendation?
Best,
Dennis
On 29/11/2023 15:51, Joseph Salowey wrote:
RFC 8773 (TLS 1.3 Extension for Certificate-Based Authentication with
an External Pre-Shared Key) was originally published as experimental
due to lack of implementations. As part of implementation work for the
EMU workitem draft-ietf-emu-bootstrapped-tls which uses RFC 8773 there
is ongoing implementation work. Since the implementation status of RFC
8773 is changing, this is a consensus call to move RFC 8773 to
standards track as reflected in
[RFC8773bis](https://datatracker.ietf.org/doc/draft-ietf-tls-8773bis).
This will also help avoid downref for the EMU draft. Please indicate
if you approve of or object to this transition to standards track
status by December 15, 2023.
Thanks,
Joe, Sean, and Deirdre
_______________________________________________
TLS mailing list
TLS@ietf.org
https://www.ietf.org/mailman/listinfo/tls
_______________________________________________
TLS mailing list
TLS@ietf.org
https://www.ietf.org/mailman/listinfo/tls
