Re: [TLS] draft-nir-tls-eap-03

[pgut001@xxxxxxxxxxxxxxxxx (Peter Gutmann)]

Yoav Nir <ynir@xxxxxxxxxxxxxx> writes:

>Regarding section 4.2 (comment (5)) I also believe that identity protection
>is important, but that belief is not universally shared. For example, the
>TLS-PSK protocol does not provide it. I'm not sure what I can do to elaborate
>more on this, except to say (as we have) that "we believe that identity
>protection is a worthy enough goal, so as to justify the extra round-trip.".
>Can you suggest anything stronger?

What about allowing the client to specify whether it wants identity protection
or not, to save the extra RTT?  All you'd need is to allow the client to
specify their identity in the hello (as the draft indicates), if the server
gets a client ID as an extension in the hello then they can go straight to the
fastpath version, otherwise there's an extra RTT.  Identity protection seems
to be one of those things that only geeks actually care about - I've never
encountered any user that's even asked about this, but I have had several
queries from users working in resource-constrained environments about how to
minimise the handshake overhead, so a fastpath option would be a good thing.

(Alternatively, make fastpath the default and do an anon-DH + rehandshake with
TLS-EAP if identity protection is really such a big deal).

Peter.
_______________________________________________
TLS mailing list
TLS@xxxxxxxx
https://www.ietf.org/mailman/listinfo/tls