Re: [Cfrg] Salsa20 stream cipher in TLS

[Simon Josefsson <[e-mail]>]

Wan-Teh Chang <[e-mail]> writes:

> On Sun, Mar 17, 2013 at 3:51 PM, Simon Josefsson <[e-mail]> wrote:
>> All,
>>
>> FYI, we have published -00 of a draft that describes how the Salsa20
>> stream cipher can be added to TLS and DTLS, see:
>>
>> http://tools.ietf.org/html/draft-josefsson-salsa20-tls
>
> Hi Simon,
>
> I am interested in this work. I am especially interested in your plan
> to allow the salsa20 cipher suites to be used in TLS 1.0 and TLS
> 1.1, which you stated in the first paragraph of the Introduction
> section.
>
> Since all of the new cipher suite names end in _SHA256, I
> infer the MAC algorithm is hmac_sha256. (The fact is
> not explicitly stated in the -00 draft.)

Hi Wan-Teh and thank you for the review.  Good catch, I have added a
paragraph explaining what the MAC algorithm should be.

> It is important to clarify how hmac_sha256 can be used in TLS 1.0 and
> TLS 1.1, because a naive implementor would see the old definition of
> MACAlgorithm in TLS 1.0 and 1.1:
>
>     enum { null, md5, sha } MACAlgorithm;
>
> and conclude that hmac_sha256 can't be used in TLS
> 1.0 and 1.1.

Right.

Would adding a set of cipher suites that use HMAC-SHA1 resolve this?  We
have added them already in our working copy for performance reasons.  It
is not clear whether there is any point in also having HMAC-SHA256, it
destroys the performance properties.

> I'm also interested in figuring out if these cipher suites
> can be used in SSL 3.0. The only difficulty I see is
> extending the SSL 3.0 MAC algorithm to hash=sha256
> (see the definition of the SSL 3.0 MAC in Section 5.2.3.1
> of RFC 6101) -- it is not clear what should be the size of
> pad_1 and pad_2 for hash=sha256.

I'm hoping that using HMAC-SHA1 here would solve this too, right?

> The reason I'm interested in SSL 3.0 is that web browsers,
> when talking to Google servers, which implement TLS/SSL
> version negotiation correctly, are still downgraded to SSL 3.0
> by network errors injected by certain network devices.

Having compability with SSL 3.0 would be nice.  The next version will
mention SSL 3.0 compatibility too.

/Simon