Re: [TLS] MTI policy & practice (Was: Re: Comments on various things on agenda)

[Dave Garrett <[e-mail]>]

On Tuesday, March 10, 2015 08:33:45 pm Watson Ladd wrote:
> On Mar 9, 2015 4:11 PM, "Dave Garrett" <[e-mail]> wrote:
> > On Monday, March 09, 2015 06:38:08 pm Aaron Zauner wrote:
> > > In any case, people do argue that algorithmic agility causes more
> > > problems than it's worth. I agree somewhat, but IMHO at least one
> > > backup is a good idea
> >
> > I'd much rather have three than two. (not counting deprecated
> > ciphers/modes) I think of it in this way: if one were to vanish, there
> > would still be a choice left. With only two chosen ones, then a fatal
> > attack on one brings us all the way back to the one-true-cipher again.
> >
> > If you assume eventual failure, a secondary backup is very desirable.
> 
> Both AES-CCM and AES-GCM have security reducing to that of AES as a PRP. So
> they aren't actually independent backups. The issue is that extremely
> limited hardware may only support AES-CCM.

Yes, to be clear, I'm saying we'd ideally want an ecosystem with 3 ciphers, not 3 cipher suites. (the discussion drifted and the words are fuzzy) Too few results in failing back to a risky point, and too many risks fragmenting cipher support and interop too much.

Referencing the whole zoo of newer AES AEAD modes in the TLS 1.3 spec is probably worthwhile, but picking just one for MTI probably means GCM. Hey, if we can do ~another~ MTI, we could go: Chacha/Poly + AES-GCM + one other AES mode, all MTI, with Chacha/Poly as MTD.


Dave