[Cryptography] Is it time for a revolution to replace TLS?

[ianG]

On 15/04/2014 19:35 pm, Tony Arcieri wrote:
> http://clearcryptocode.org/tls/

I see you've added commentary on the CurveCP variants, thanks!  Still
shy on the google QUIC offering, which makes me think it is even more
worthwhile to hear ;)


> Probably not going to happen, but it's nice to dream...


I think it is going to happen.  Without some direction, we know that the
TLS wg will simply do what they always do -- incremental fixes and more
ciphersuites.  Reactive to events, not to the big picture.



People are beginning to realise that a big change is needed.  E.g.,
this:  "One way or another, we need encryption for TCP streams that we
can trust."

No, we don't.  What we need is (a) a reliable request-response protocol
that allows packets to go back and forth between end-points reliably,
and (b) a subscription packet distribution service (chat, flashy web
updates).

We don't need streams.  We never needed streams for the original use
case, being protecting credit cards in the web.  The one place we really
absolutely need streams is secure terminals, and SSH doesn't use TLS.
Go figure.

It's all a myth.  What happened was that HTTP used TCP because it was
too lazy to do its own connection & packet reliability layer.  It got
streams not packets coz it didn't know the difference.  We've been
suffering this misconception ever since.



This is why I suggest a reset.

The system is way old, and the use case and design has been roundly
trashed.  The players are locked in deadly embrace.  We need new
original thinking, and we need reset thinking (like CurveCP's suggestion
to do away with KEX).

It has to be done at an individual level because the instant we get into
committee, there will be people blocking any movement forward because
others aren't supporting their vanity suite.

We already have market evolution at the individual level:  things like
CurveCP and QIUC gaining supporters and battle it out in the market
place.  I think they are on the right track (disclosure: I do something
similar myself with UDP-based request-response protocol called SOX) but
I wonder whether one individual team can find enough support, enough
breadth?

How can we accelerate the process of individual teams,
cross-fertilisation of ideas and of the needs cases, and also the
building of consensus?

A competition.

It's not that far away, we already know how to do competitions, e.g.,
CAESAR.



iang