Re: [Cfrg] Salsa20 stream cipher in TLS

[Jon Callas <[e-mail]>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Mar 20, 2013, at 2:55 AM, David McGrew (mcgrew) <[e-mail]> wrote:

> TLSv1.2 barely mentions either GCM or ECC, much less requires their use.
> RFC 5246 says: in the absence of an application profile standard
> specifying otherwise, a TLSv1.2-compliant application MUST implement the
> cipher suite TLS_RSA_WITH_AES_128_CBC_SHA.  No ECC or GCM ciphersuites are
> mentioned in that RFC.  On the flip side, there are benefits in using that
> version; v1.2 allows to use SHA256 in key derivation (PRF) and message
> authentication (HMAC), allows the use of AEAD, and adds other fixes.
> 
> GCM does require a distinct nonce for each encryption operation, which
> makes it vulnerable to "nonce misuse", or makes it tetchy as you say.
> However, this property is a non-issue in TLS, since it is easy to use a
> sequence number as a nonce, and session keys don't persist between
> sessions.   For comparison, Salsa20 and UMAC, both recently mentioned on
> this thread, would also have exactly the same distinct-nonce requirement,
> and essentially RC4 does as well (in the sense that an application that
> mis-manages the RC4 state would likely cause a loss of confidentiality).

I apologize for note being organized in my typing. Let me try again.

Rightly or wrongly, there's a perception both on the implementation end and the deployment end that TLS 1.2 is the "Suite B" version of TLS, that it's mandatory to implement and mandatory to deploy. That this is a misperception is in fact what part of the problem is. I've held many of these misperceptions myself, and if someone as expert as I doesn't grok TLS 1.2, then how is the average developer or sysadmin going to understand?

TLS 1.2 needs some marketing that explains why people want it, and that needs to include reassurance that it doesn't require you to commit to ECC and GCM. Many people out there believe precisely this.

	Jon


-----BEGIN PGP SIGNATURE-----
Version: PGP Universal 3.2.0 (Build 1672)
Charset: us-ascii

wj8DBQFRSkwdsTedWZOD3gYRAkWSAKCxRRMWVhNq2NF1ihkX17sFU4hqGACgjo/9
RJSto/qI8hZe5T6wz9YBrNQ=
=6tCp
-----END PGP SIGNATURE-----