Batch Signing for TLS
draft-ietf-tls-batch-signing-00
TLS D. Benjamin
Internet-Draft Google LLC
Intended status: Experimental January 13, 2020
Expires: July 16, 2020
Batch Signing for TLS
draft-ietf-tls-batch-signing-00
Abstract
This document describes a mechanism for batch signing in TLS.
Status of This Memo
This Internet-Draft is submitted in full conformance with the
provisions of BCP 78 and BCP 79.
Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF). Note that other groups may also distribute
working documents as Internet-Drafts. The list of current Internet-
Drafts is at https://datatracker.ietf.org/drafts/current/.
Internet-Drafts are draft documents valid for a maximum of six months
and may be updated, replaced, or obsoleted by other documents at any
time. It is inappropriate to use Internet-Drafts as reference
material or to cite them other than as "work in progress."
This Internet-Draft will expire on July 16, 2020.
Copyright Notice
Copyright (c) 2020 IETF Trust and the persons identified as the
document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents
(https://trustee.ietf.org/license-info) in effect on the date of
publication of this document. Please review these documents
carefully, as they describe your rights and restrictions with respect
to this document. Code Components extracted from this document must
include Simplified BSD License text as described in Section 4.e of
the Trust Legal Provisions and are provided without warranty as
described in the Simplified BSD License.
Benjamin Expires July 16, 2020 [Page 1]
Internet-Draft Batch Signing for TLS January 2020
Table of Contents
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2
2. Conventions and Definitions . . . . . . . . . . . . . . . . . 2
3. Batch SignatureSchemes . . . . . . . . . . . . . . . . . . . 3
3.1. Signing . . . . . . . . . . . . . . . . . . . . . . . . . 4
3.2. Verifying . . . . . . . . . . . . . . . . . . . . . . . . 6
4. Security Considerations . . . . . . . . . . . . . . . . . . . 7
4.1. Correctness . . . . . . . . . . . . . . . . . . . . . . . 7
4.2. Domain Separation . . . . . . . . . . . . . . . . . . . . 7
4.3. Payload Confidentiality . . . . . . . . . . . . . . . . . 8
4.4. Information Leaks . . . . . . . . . . . . . . . . . . . . 8
5. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 9
6. Normative References . . . . . . . . . . . . . . . . . . . . 9
Appendix A. Test Vectors . . . . . . . . . . . . . . . . . . . . 10
Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . . . 10
Author's Address . . . . . . . . . . . . . . . . . . . . . . . . 10
1. Introduction
TLS [RFC8446] clients and servers authenticating with certificates
perform online signatures with the private key associated with their
certificate. In some cases, signing throughput may be limited. For
instance, RSA signing is CPU-intensive compared to many other
algorithms used in TLS. The private key may also be stored on a
hardware module or be accessed remotely on another server. Under
load, this can result in DoS concerns or impact system performance.
To mitigate these concerns, this document introduces a mechanism for
batch signing in TLS. It allows TLS implementations to satisfy many
concurrent requests with a single signing operation, at a logarithmic
cost to signature size. A server under load could, for instance,
preferentially serve batch-capable clients as part of its DoS
strategy.
2. Conventions and Definitions
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and
"OPTIONAL" in this document are to be interpreted as described in BCP
14 [RFC2119] [RFC8174] when, and only when, they appear in all
capitals, as shown here. All TLS notation comes from section 3 of
[RFC8446].
Benjamin Expires July 16, 2020 [Page 2]
Internet-Draft Batch Signing for TLS January 2020
3. Batch SignatureSchemes
A batch SignatureScheme signs a number of input messages from
different connections concurrently and returns a corresponding batch
signature for each input message.
Each SignatureScheme is parameterized by the following:
o A base signature algorithm
o A hash function
This document defines the following values:
enum {
ecdsa_secp256r1_sha256_batch(TBD1),
ecdsa_secp384r1_sha384_batch(TBD2),
Show full document text