Re: [kitten] New EncTypes?

[Viktor Dukhovni <[e-mail]>]

On Wed, Nov 18, 2015 at 04:20:41PM -0800, Henry B (Hank) Hotz, CISSP wrote:

> It seems to be time to do housecleaning on algorithms selections. Is anyone
> interested in adding a new enctype to Kerberos?

Yes, but see below.

> Why (else)?  Speaking strictly for myself, I�d like to see a
> mandatory-to-implement enctype that shares *nothing* with the current
> aes-sha1-hmac stuff. I�m speaking purely strategically and not from any
> mathematical suspicion of weakness. If someone discovers something
> fundamentally wrong with the math behind SHA1 or AES, then it might take
> out SHA2 or Camellia as well.

Sharing nothing is much too radical, unlikely to get much adoption.
There is too much momentum behind AES (hardware support in modern
CPUs, ...) and no substantive evidence of any real concerns (beyond
the long-understood timing side-channel issues with naive software-only
implementations).

> Just to throw some straw (just straw, not an actual strawman) on the table,
> how about something that uses one of the European stream cipher finalists
> with SHA-3?

As a backup, sure, but SHA-3 is quite slow, and has no hardware
support.  The throught of GSSAPI wrap is largely dominated by SHA-1
performance these days.  We'd be much better off with OCB, or
another AEAD mode.

And we could use an updated set of AES enctypes, before jumping to
more exotic stream ciphers.

-- 
	Viktor.