Proposal Details
As part of the runtimesecret experiment, I've implemented a CL on top of crypto/tls that uses the runtime/secret mechanism to ensure forward secrecy. While the initial thought was to use runtime/secret for all TLS connections, the overhead proved too costly for some of the lighter cryptographic ciphersuites, resulting in a ~30% increase in handshake times in benchmarks.
In light of this, it would be useful to have an option for users to turn on/off the mechanism. The initial idea is to add a method on tls.Config like so:
// SetEnhancedForwardSecrecy sets whether the connection uses the
// "runtime/secret" mechanism to enhance forward secrecy for ciphersuites that
// support it.
//
// Note that there is some overhead associated with this mechanism and the
// protection offered is against attackers that have arbitrary access to memory.
// It is unlikely that most users will see much benefit to enabling this option.
func (c *Config) SetEnhancedForwardSecrecy(b bool)
If/when runtimesecret graduates, we can deprecate the method and expose the field directly in tls.Config
Proposal Details
As part of the
runtimesecretexperiment, I've implemented a CL on top ofcrypto/tlsthat uses theruntime/secretmechanism to ensure forward secrecy. While the initial thought was to useruntime/secretfor all TLS connections, the overhead proved too costly for some of the lighter cryptographic ciphersuites, resulting in a ~30% increase in handshake times in benchmarks.In light of this, it would be useful to have an option for users to turn on/off the mechanism. The initial idea is to add a method on tls.Config like so:
If/when
runtimesecretgraduates, we can deprecate the method and expose the field directly intls.Config