[secdir] secdir review of draft-ietf-tls-chacha20-poly1305

"Dan Harkins" <dharkins@lounge.org> Mon, 04 April 2016 15:14 UTC

Message-ID: <10417009fba695628b364f7d191f1672.squirrel@www.trepanning.net>
Date: Mon, 04 Apr 2016 08:14:46 -0700
From: Dan Harkins <dharkins@lounge.org>
To: iesg@ietf.org, secdir@ietf.org, draft-ietf-tls-chacha20-poly1305.all@tools.ietf.org
User-Agent: SquirrelMail/1.4.14 [SVN]
MIME-Version: 1.0
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: 8bit
Importance: Normal
Archived-At: <http://mailarchive.ietf.org/arch/msg/secdir/vzQRIJfPkvc8l3rNtEMV1fBP0_c>
Subject: [secdir] secdir review of draft-ietf-tls-chacha20-poly1305
Precedence: list

  Greetings,

  I have reviewed this document as part of the security directorate's
ongoing effort to review all IETF documents being processed by the
IESG.  These comments were written primarily for the benefit of the
security area directors.  Document editors and WG chairs should treat
these comments just like any other last call comments.

  The draft defines how to use the chacha20+poly1305 AEAD mode
in TLS. chacha is a cipher mode "designed by D.J. Bernstein" and
poly1305 is an authenticator "designed by D.J. Bernstein" (as the
draft sees necessary to mention) and the two have been combined
into an AEAD mode as defined in RFC 7539. This draft just says
to use the method of AEAD incorporation that the TLS specification
(RFC 5246) defines to put this AEAD mode into (D)TLS. It asks for
7 new TLS cipher suites.

  It's very concise and I consider it "Ready". That said, I'd add
a personal nit (which doesn't rise to the level of "Ready with nits")
that it's probably not necessary to have both a TLS_PSK_WITH and a
PSK_ECDHE_PSK_WITH cipher suite and would prefer doing away with
the former.

  regards,

  Dan.

[secdir] secdir review of draft-ietf-tls-chacha20… Dan Harkins