Re: [saag] A case against algorithm agility (long)

[Nico Williams <[e-mail]>]

On Mon, May 5, 2014 at 12:26 PM, ianG <[e-mail]> wrote:
> On 5/05/2014 16:15 pm, Nico Williams wrote:
>> On Sat, May 3, 2014 at 10:45 AM, ianG <[e-mail]> wrote:
>
>> I also agree that cipher and cipher mode MUST be negotiated as
>> registered pairs, not a la carte.  This is pretty clear, and I don't
>> know anyone who is arguing otherwise.
>
>
> Meet the draft:
>
> https://datatracker.ietf.org/doc/draft-iab-crypto-alg-agility/?include_text=1
>
> Especially 2.1:
>
>    Some approaches carry one identifier for each algorithm that is used.
>    Other approaches carry one identifier for a suite of algorithms.
>    Either approach is acceptable; however, designers are encouraged to
>    pick one of these approaches and use it consistently throughout the
>    protocol.
>
> Before we go further, can we just agree on what the above says, and what
> the draft implies?

Not really.  It's not clear that the quoted text means that cipher and
cipher mode can be negotiated separately.  I don't think anyone has
proposed such a thing in recent times (years).

> I think it says that "a la carte" is acceptable, to use your term.

As a term or as a concept?

> ...
>
>> Nonsense.  The CBC IV chaining bugs were exploited against SSHv2.  We
>> were very glad back then to have deployed AES in counter mode as that
>> saved our butts.
>
> Any reference to that?

I don't have one handy.  I was at a vendor at the time and we had
already shipped AES in counter mode (with HMAC for authentication), so
it was easy for us to tell our customers what configuration changes
needed to be done to address the problem.

Nico
--