Re: [TLS] Please discuss: draft-housley-evidence-extns-00

[Eric Rescorla <ekr@xxxxxxxxxxxxxxxxxxxx>]

"Mark Brown" <mark@xxxxxxxxxxxxxxxxxxxx> writes:

> Eric,
>
>> I think "not great" is quite an understatement here. You've just
>> required that every TLS record write requires *two* signatures,
>> one from the sender and one from the receiver. This includes
>> record read/writes which the application doesn't even care
>> about having evidence for. Your typical brokerage transaction
>> requires 10s if not hundreds of separate HTTP fetches, each
>> of which requires one or more record in each direction. Doing
>> 25 digital signatures for every transaction is an enormous
>> load on the server.
>
> Turn on TLS Evidence only for one POST, skip the GETs.  There's typically
> one important POST per transaction, the one before the
> print-this-page-for-your-records response.  That's the page the user
> typically prints for evidence of the transaction, despite its failings.

Yes, but *now* you're in the business of having the application
require tight control of when signatures are created and when
they're available, which brings us back to the situation I
was complaining about in my initial review, where this isn't
just automatic, it requires esxtensively modifying the
app, plus the race condition/lockstep issues I raised in my
original review.


> It doesn't make sense to create TLS Evidence for every fetch.  What would be
> the point of being able to show for posterity that some browser downloaded
> 20 gifs, a css file and two javascript files?  None.

I totally agree with that. That's the virtue of a message signing
scheme like S/MIME.


> Regarding performance estimates, whether you use a FIPS 140 accelerator or
> not, the cost of two digital signatures and the extra TLS Evidence messages
> is less than the 20+ round trips made to load the page, even if the client
> is using multiple connections.  

It depends what you're measuring, latency or CPU time. The dominant
CPU cost of SSL/TLS is the RSA key exchange (which is commensurate cost
with signing, of course)[0]. Providing evidence (independent signatures)
for a single request/response pair entails that the server do two 
additional signatures (one in response to the Evidence-Request for
the client request and one in its Evidence-Request for the response).
This substantially increases the server load quite a bit beyond the
symmetric crypto cost. And of course there's no guarantee that
a request or response goes in a single TLS record, which may or
may not be the case.

-Ekr

[0] C. Coarfa, P. Druschel, and D. Wallach. Performance Analysis of
TLS Web Servers. In Proceedings of NDSS '02, 2002. 0

_______________________________________________
TLS mailing list
TLS@xxxxxxxxxxxxxx
https://www1.ietf.org/mailman/listinfo/tls