Re: [Cfrg] Salsa20 stream cipher in TLS

[Simon Josefsson <[e-mail]>]

Wan-Teh Chang <[e-mail]> writes:

> Although it may be possible to retrofit GenericAEADCipher into TLS 1.0 and
> 1.1, the existing implementations of the AES-GCM cipher suites restrict them
> to TLS 1.2, so there will still be interoperability problems.

Implementations could be fixed here, if we want to.  There may still be
interop problems, but there will always be interop problems so
implementations need to handle them anyway.

> Assuming we can solve the problems of using GenericAEADCipher and
> updating key expansion in TLS 1.0 and 1.1, new AEAD cipher suites can
> describe how they will be used in older versions of TLS from day one.
> So it still seems worthwhile to solve the problem of using AEAD cipher
> suites in TLS 1.0 and 1.1.

That may be useful, and would likely have helped adoption of AEAD
ciphers in TLS if it was done from the start.

I'm not sure why TLS 1.2 isn't negotiated more often by browsers.  If it
is an implementation issue, I'm not convinced specifying AEAD ciphers
for TLS 1.0 and TLS 1.1 will help: they just get another implementation
issue to implement that instead.  Admittedly, it is a different
implementation task, so it may be fixed earlier than the other issue,
but that is difficult to predict.  Generally, it might be better to push
browsers vendors to switch to TLS 1.2 more quickly, then the problem is
also solved.

/Simon