Re: [rtcweb] Open Security issue: Crypto algorithms

[Justin Uberti <[e-mail]>]

On Wed, May 20, 2015 at 5:56 AM, Sean Turner <[e-mail]> wrote:

> On May 07, 2015, at 09:46, Martin Thomson <[e-mail]>
> wrote:
>
> > On 7 May 2015 at 02:38, Ted Hardie <[e-mail]> wrote:
> >> I am not chair with the particularly good position to collect feedback,
> but
> >> I happen to know he's flying today.  My understanding of the current
> theory
> >> is that we ask TLS what cipher suites and version numbers to mandate;
> if we
> >> had a strong reason to disagree, we would need to document why we went
> with
> >> something other than what they suggested.
> >>
> >> He-who-is-in-the-air may tell me I've got it wrong, of course.
> >
> > Sounds good, perhaps we should ask he-who-will-eventually-land to pass
> > on the question, unless we both are wrong.
>
> On it - albeit a little late. It’s worth noting that the UTA BCP195 (RFC
> 7525) (Recommendations for Secure Use of Transport Layer Security (TLS) and
> Datagram Transport Layer Security (DTLS)) was recently published and
> recommends this set of algorithms:
>
>    o  TLS_DHE_RSA_WITH_AES_128_GCM_SHA256
>    o  TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
>    o  TLS_DHE_RSA_WITH_AES_256_GCM_SHA384
>    o  TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
>
> I also admit that I prefer ECDSA, primarily for smaller certs for
> comparable security, but acknowledge Martin’s point about the cert
> management APIs.
>

I'd also like to see ECDSA mandated, since it is much more friendly for
low-power devices.