Subject: [TLS] How to reduce number of verifications

From: Watson Ladd <[email-masked]>
Date: Mon, 2 Mar 2015 22:03:41 -0800

Dear all,

Right now it looks like browsers will need to conduct a lot of
signature verifications. First, they will need to verify the
certificate chain. Second, they will need to validate OCSP. Thirdly,
they will need to validate CT records, when Certificate Transparency
is deployed.

Most of these signatures are not online. All of them can safely be
done with currently deployed RSA 2048, or a 255 bit elliptic curve.
None of them require more security, as future cryptanalysis cannot
affect today's authentication.

We should consider carefully studying which combinations of algorithms
for which signatures will provide the most performance, as well as how
we can minimize the number of verifications that will take place. I've
not done that much in this direction: it comes down to the marginal
cost of batch verification of Schnorr-like schemes vs. straight RSA
verification when we don't have online signing.

Sincerely,
Watson Ladd

---

From: Ben Laurie <[email-masked]>
Date: Tue, 3 Mar 2015 14:07:51 +0000

> they will need to validate CT records, when Certificate Transparency

FYI, CT is already deployed for EV certificates.

> affect today's authentication.

Insofar as CT is also a record of history, it is possible that one might
want to re-sign existing trees at some point (or, rather, re-publish them
with different algorithms).