Hello, We have prepared the following draft, and request feedback on it. The main points are
* Introduction of (anonymous) Kerberos tickets as added entropy to mix with ECDH, and thereby provide Quantum Relief; it generalises this idea to allow for other ways of adding entropy * Introduction of Kerberos Tickets for Certificate and CertificateVerify messages * User identity on the server side; how TLS can be relayed to a peer, which Kerberos can handle with its user-to-user authentication mechanism; it generalises this idea, and perhaps it might be better as a separate TLS Extension under ClientHello encryption. * Everything applies to TLS 1.3 as well as 1.2. Our intention is to launch this as an independent proposal. Your insights are highly appreciated! Best, Rick van Rein Tom Vrancken A new version of I-D, draft-vanrein-tls-kdh-06.txt has been successfully submitted by Rick van Rein and posted to the IETF repository. Name: draft-vanrein-tls-kdh Revision: 06 Title: Quantum Relief with TLS and Kerberos Document date: 2020-01-22 Group: Individual Submission Pages: 19 URL: https://www.ietf.org/internet-drafts/draft-vanrein-tls-kdh-06.txt Status: https://datatracker.ietf.org/doc/draft-vanrein-tls-kdh/ Htmlized: https://tools.ietf.org/html/draft-vanrein-tls-kdh-06 Htmlized: https://datatracker.ietf.org/doc/html/draft-vanrein-tls-kdh Diff: https://www.ietf.org/rfcdiff?url2=draft-vanrein-tls-kdh-06 Abstract: This specification describes a mechanism to use Kerberos authentication within the TLS protocol. This gives users of TLS a strong alternative to classic PKI-based authentication, and at the same introduces a way to insert entropy into TLS' key schedule such that the resulting protocol becomes resistant against attacks from quantum computers. We call this Quantum Relief, and specify it as part of a more general framework to make it easier for other technologies to achieve similar benefits. _______________________________________________ TLS mailing list TLS@ietf.org https://www.ietf.org/mailman/listinfo/tls
