Re: [TLS] Ala Carte Cipher suites - was: DSA should die

[Tony Arcieri <[e-mail]>]

On Sat, Apr 4, 2015 at 4:55 PM, Salz, Rich <[e-mail]> wrote:

> > Please don't change the syntax for negotiating cipher suites.
>
> +1, for the reasons Brian said.


Looks like the opinion of TLS implementers is this far unanimously against
this proposal. I would like to give the counterpoint from a TLS user
perspective.

I am more or less in charge of the ciphersuite selection for a large web
site with a lot of users. I find the present means of describing
ciphersuites to TLS stacks to be difficult at best. As myself and many
others have described, we're essentially being asked to compute the
combinatorial explosion of different ciphersuite configurations by hand.
Guess what happens when you do that? People make mistakes. I think the TLS
libraries should have an easier-to-use configuration format that computes
things for me so I don't have to. I understand why TLS implementers are
reluctant to provide that. It's more work for them. But so far none of them
have said why this is qualitatively bad.

The proposed approach of splitting up what is more or less key exchange vs
symmetric cipher configuration (please excuse that rough description, I
know how deep the rabbit hole under this bikeshed goes) and require you
specify both parts in order of preference sounds like it should fit within
all of the existing TLS configuration frameworks and notations. People
would only use the new syntax with TLS 1.3+ compatible libraries, and it
should be fully backwards compatible with the old one.

I also think that requiring this sort of configuration could help designers
TLS tease out these concepts internally so they aren't colluded into an
amorphous mush of algorithms, every possible combination of which a TLS
deployer is expected to whitelist.

Seems like a huge win to me. So what's the problem from an implementer
perspective besides "it'd be hard"?