Re: [TLS] AES-OCB in TLS [New Version Notification for draft-zauner-tls-aes-ocb-03.txt]

[Aaron Zauner <[e-mail]>]

Hi,

Jeffrey Walton wrote:
> What do you suggest for resource constrained devices? What are the
> remaining choices?

There're none.

> When the device cannot do public key, they often use PSK.
> 
> PSK also has two desirable properties: channel binding and mutual
> authentication, and most other cipher suites don't provide them.
> 

I agree, but am unsure to what extent they are used in real life. I'm
trying to reduce the number of cipher-suites that would have to be added
to the IANA TLS parameter list; since PSK is unsupported with GCM
cipher-suites it seems only logical to exclude them here as well.
Because I regularly receive off-list mail that PSK is indeed wanted,
I've not yet removed those cipher-suites.

RFC3268 (CBC modes) also excludes TLS-PSK ciphersuites. There seems to
be a seperate document that deals with TLS-PSK namely RFC5487 (defines
GCM and CBC PSK cipher-suites). It might make sense to update this
document in case OCB mode get's accepted by the TLS-WG instead.

BTW: is TLS-SRP in use anywhere?

Aaron