Subject: [TLS] Don't fix Triple Handshake

From: Watson Ladd <[email-masked]>
Date: Sun, 20 Jul 2014 11:50:25 -0700

Instead, create a secure key exchange protocol. Actually, don't do
that: just steal one.

Why is this a good idea?
1: Get to use analysis work already done
2: Avoids making mistakes
3: Now that CCS and Finished is potentially on the chopping block, we
can actually make
a key exchange protocol satisfying standard properties, and couple to
a record layer that is secure, about 20 years too late.

Sincerely,
Watson Ladd

(Note that we need an additional property: as Hugo Krawczyk was kind
enough to point out to me channel binding is not necessarily supported
by any key-exchange protocol)