Re: [Cfrg] [TLS] Salsa20 stream cipher in TLS

[Peter Gutmann <[e-mail]>]

Adam Langley <[e-mail]> writes:
>On Wed, Mar 20, 2013 at 7:53 PM, Jon Callas <[e-mail]> wrote:
> TLS 1.2 needs some marketing that explains why people want it, and that
> needs to include reassurance that it doesn't require you to commit to ECC 
> and GCM. Many people out there believe precisely this.
>
>I believe that the reason that TLS 1.2 hasn't seen wider deployment is that
>it causes compatibility issues and the motivation hasn't previously been
>strong enough.

Exactly.  Getting back to Jon's point that "it needs some marketing that
explains why people want it", I can't think of any reason why you'd want it.
It causes compatibility problems, but I can't think of any pressing issue that
it solves apart from "we need to do Suite B".  This is why it's seen as "TLS
with Suite B", because that's it's sole marketing point.

Look at OCSP pinning as a counterexample.  Virtually every major site deployed
this as quickly as they could, because the site owners recognised that if they
didn't do it, they'd take a significant performace hit or even complete OCSP-
induced site outages (on hard fail).

If you don't deploy TLS 1.2 OTOH, nothing happens.  You're no slower, no less
available, no less secure... the only thing you don't have is Suite B.  I
implemented it some time ago and so far the sole users have been (a) a small
number of users who wanted Suite B and (b) an even smaller number of users,
mostly in Europe, who insisted on having the largest version number of TLS
they could get.  Most of the latter went back to 1.1 when they started running
into problems with interoperability.

Peter.