Re: Gen-ART LC review of draft-ietf-tls-chacha20-poly1305-04

Re: Gen-ART LC review of draft-ietf-tls-chacha20-poly1305-04 - resend

Wan-Teh Chang <wtc@google.com> Thu, 05 May 2016 13:58 UTC

MIME-Version: 1.0
In-Reply-To: <4E747344-7607-4715-8A88-A48FE1B3E70C@gmail.com>
References: <017a01d190ca$ace223b0$06a66b10$@gmail.com> <A8A038B3-E10F-4A94-99D3-2C4D23A6E065@sn3rd.com> <00d901d191a4$185fa340$491ee9c0$@gmail.com> <4E747344-7607-4715-8A88-A48FE1B3E70C@gmail.com>
Date: Thu, 05 May 2016 06:55:38 -0700
Message-ID: <CALTJjxHQNvwj4Ms9c5RhfxHXu4YpyUN7dckTxTJgwPz3Qn8=ww@mail.gmail.com>
Subject: Re: Gen-ART LC review of draft-ietf-tls-chacha20-poly1305-04 - resend
From: Wan-Teh Chang <wtc@google.com>
To: Yoav Nir <ynir.ietf@gmail.com>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Archived-At: <http://mailarchive.ietf.org/arch/msg/ietf/4d1JowhLa_IijjcDE8SM4NjNOZ8>
Cc: gen-art@ietf.org, draft-ietf-tls-chacha20-poly1305.all@ietf.org, ietf@ietf.org
Precedence: list

On Thu, May 5, 2016 at 5:41 AM, Yoav Nir <ynir.ietf@gmail.com> wrote:
> Hi Roni.
>
> I think I can explain one of your questions.
>
>
>> On 8 Apr 2016, at 5:36 PM, Roni Even <ron.even.tlv@gmail.com> wrote:
>
> <snip />
>
>>> Also note, the registry rules are:
>>>
>>> 0-191        Standards Action                        Refers to value of first byte
>>> 192-254      Specification Required          Refers to value of first byte
>>> 255          Reserved for Private Use        Refers to value of first byte
>> [Roni Even] So  I would like to assume that there was a reason to have two different policies so why not follow it.
>
> <snip />
>
>
>>> From  RFC4346 a.5 "Cipher suite values with first byte decimal 192 (0xC0) through
>>         decimal 254 (0xFE) inclusive are reserved for assignment for
>>         non-Standards Track methods."
>>
>> So this is the reason to have the registration as non standard document.   I looked at Camellia and it follows your explanation except for updating the TLS specification yet it uses the first byte from the range 0-191.  So my question will be why did you use the first byte from 192 - range?
>
> The WG specifically requested these values. Google was eager to have this algorithms in Chrome, so they chose some values at (almost) random that were not being used by anyone else.

The first cipher suite values we (I remember it was Adam Langley)
chose for our experiments were actually mnemonics: 0xCC13 and 0xCC14,
where "CC" suggests ChaCha and "13" suggests Poly1305. You can see
these values in the sslproto.h file in the first NSS patch:

https://codereview.chromium.org/23619044/diff/31001/net/third_party/nss/ssl/sslproto.h

The definitions of those two cipher suites have since changed, so we
had to change their cipher suite values. But I asked the co-author
Nikos to keep the first byte as 0xCC. I don't know how Nikos chose the
range of the values of the second byte (starting with 0xA0, now 0xA8 -
0xAE).

Wan-Teh Chang

Gen-ART LC review of draft-ietf-tls-chacha20-poly… Roni Even
Gen-ART LC review of draft-ietf-tls-chacha20-poly… Roni Even
Re: Gen-ART LC review of draft-ietf-tls-chacha20-… Sean Turner
RE: Gen-ART LC review of draft-ietf-tls-chacha20-… Roni Even
Re: Gen-ART LC review of draft-ietf-tls-chacha20-… Jari Arkko
Re: Gen-ART LC review of draft-ietf-tls-chacha20-… Yoav Nir
Re: Gen-ART LC review of draft-ietf-tls-chacha20-… Wan-Teh Chang