Batch Signing for TLS
draft-davidben-tls-batch-signing-00

• Status
• IESG evaluation record
• IESG writeups
• Email expansions
• History

• Versions
• 00

TLS                                                          D. Benjamin
Internet-Draft                                                Google LLC
Intended status: Experimental                              July 29, 2019
Expires: January 30, 2020

                         Batch Signing for TLS
                  draft-davidben-tls-batch-signing-00

Abstract

   This document describes a mechanism for batch signing in TLS.

Status of This Memo

   This Internet-Draft is submitted in full conformance with the
   provisions of BCP 78 and BCP 79.

   Internet-Drafts are working documents of the Internet Engineering
   Task Force (IETF).  Note that other groups may also distribute
   working documents as Internet-Drafts.  The list of current Internet-
   Drafts is at https://datatracker.ietf.org/drafts/current/.

   Internet-Drafts are draft documents valid for a maximum of six months
   and may be updated, replaced, or obsoleted by other documents at any
   time.  It is inappropriate to use Internet-Drafts as reference
   material or to cite them other than as "work in progress."

   This Internet-Draft will expire on January 30, 2020.

Copyright Notice

   Copyright (c) 2019 IETF Trust and the persons identified as the
   document authors.  All rights reserved.

   This document is subject to BCP 78 and the IETF Trust's Legal
   Provisions Relating to IETF Documents
   (https://trustee.ietf.org/license-info) in effect on the date of
   publication of this document.  Please review these documents
   carefully, as they describe your rights and restrictions with respect
   to this document.  Code Components extracted from this document must
   include Simplified BSD License text as described in Section 4.e of
   the Trust Legal Provisions and are provided without warranty as
   described in the Simplified BSD License.

Benjamin                Expires January 30, 2020                [Page 1]
Internet-Draft            Batch Signing for TLS                July 2019

Table of Contents

   1.  Introduction  . . . . . . . . . . . . . . . . . . . . . . . .   2
   2.  Conventions and Definitions . . . . . . . . . . . . . . . . .   2
   3.  Batch SignatureSchemes  . . . . . . . . . . . . . . . . . . .   2
     3.1.  Signing . . . . . . . . . . . . . . . . . . . . . . . . .   4
     3.2.  Verifying . . . . . . . . . . . . . . . . . . . . . . . .   6
   4.  Security Considerations . . . . . . . . . . . . . . . . . . .   7
     4.1.  Correctness . . . . . . . . . . . . . . . . . . . . . . .   7
     4.2.  Domain Separation . . . . . . . . . . . . . . . . . . . .   7
     4.3.  Payload Confidentiality . . . . . . . . . . . . . . . . .   8
     4.4.  Information Leaks . . . . . . . . . . . . . . . . . . . .   8
   5.  IANA Considerations . . . . . . . . . . . . . . . . . . . . .   9
   6.  Normative References  . . . . . . . . . . . . . . . . . . . .   9
   Appendix A.  Test Vectors . . . . . . . . . . . . . . . . . . . .  10
   Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . . .  10
   Author's Address  . . . . . . . . . . . . . . . . . . . . . . . .  10

1.  Introduction

   TLS [RFC8446] clients and servers authenticating with certificates
   perform online signatures with the private key associated with their
   certificate.  In some cases, signing throughput may be limited.  For
   instance, RSA signing is CPU-intensive compared to many other
   algorithms used in TLS.  The private key may also be stored on a
   hardware module or be accessed remotely on another server.  Under
   load, this can result in DoS concerns or impact system performance.

   To mitigate these concerns, this document introduces a mechanism for
   batch signing in TLS.  It allows TLS implementations to satisfy many
   concurrent requests with a single signing operation, at a logarithmic
   cost to signature size.

2.  Conventions and Definitions

   The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
   "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and
   "OPTIONAL" in this document are to be interpreted as described in BCP
   14 [RFC2119] [RFC8174] when, and only when, they appear in all
   capitals, as shown here.  All TLS notation comes from section 3 of
   [RFC8446].

3.  Batch SignatureSchemes

   A batch SignatureScheme signs a number of input messages from
   different connections concurrently and returns a corresponding batch
   signature for each input message.

Benjamin                Expires January 30, 2020                [Page 2]
Internet-Draft            Batch Signing for TLS                July 2019

   Each SignatureScheme is parameterized by the following:

   o  A base signature algorithm

   o  A hash function

   This document defines the following values:

       enum {
           ecdsa_secp256r1_sha256_batch(TBD1),
           ecdsa_secp384r1_sha384_batch(TBD2),
           ecdsa_secp521r1_sha512_batch(TBD3),
           ed25519_batch(TBD4),
           ed448_batch(TBD5),