Re: [Cfrg] [TLS] Salsa20 stream cipher in TLS

["David McGrew (mcgrew)" <[e-mail]>]

Hi Simon,

On 3/17/13 6:51 PM, "Simon Josefsson" <[e-mail]> wrote:

>All,
>
>FYI, we have published -00 of a draft that describes how the Salsa20
>stream cipher can be added to TLS and DTLS, see:
>
>http://tools.ietf.org/html/draft-josefsson-salsa20-tls
>
>While we are not asking for WG adoption of this draft now, we are at a
>point where we would like to invite external review and solicit
>feedback.  

Some early feedback; copied CFRG.  It would be good to have review from
that community.

It is not exactly clear what problem is being addressed by this work.
Would be good to add a problem statement section.   In addition, it would
be good to provide the currently-unmet requirements to CAESAR (Competition
for Authenticated Encryption: Security, Applicability, and Robustness)
http://competitions.cr.yp.to/

Some more detailed comments, quoting from the draft:

   Recent attacks has indicated problems with CBC-mode cipher suites in
   TLS/DTLS and problems with the only supported stream cipher (RC4) in
   TLS has been known for a long time.  While AEAD cipher suites address
   these issues, concerns about performance are sometimes raised.


What are the performance concerns?   I suggest citing some relevant
performance data.

  Because the GenericStreamCipher definition in TLS does not provide
   any way to transport the Salsa20 nonce that is required for
   functionality and needed to provide the random access property, we
   let the output from the stream cipher operation be the concatenation
   of the IV and the encrypted data.


Please, define a Salsa20-based AEAD mechanism instead of a new TLS format!
 

>Some elements of the draft is still in flux.  For example,
>initial performance benchmarks suggests HMAC-SHA256 was a poor choice
>for the MAC so we are looking into UMAC and HMAC-SHA1 as alternatives.
>Still, all comments are appreciated.

If anything other than HMAC-SHA1 is used, that would underscore the value
of defining an AEAD algorithm.   If the main motivation for this work is
encryption that is computationally cheap, then it makes sense to pair the
algorithm with an authentication method with the same characteristics.

For security considerations, I suggest citing the analysis of Salsa20, and
adding a sentence or paragraph summarizing the best-known attacks.
Something like "Salsa20 has been analyzed by X independent teams, and the
best known attack breaks 8 of 20 rounds."

David

>
>/Simon
>_______________________________________________
>TLS mailing list
>[e-mail]
>https://www.ietf.org/mailman/listinfo/tls