Re: [TLS] Salsa20 stream cipher in TLS

[Wan-Teh Chang <[e-mail]>]

On Sun, Mar 17, 2013 at 3:51 PM, Simon Josefsson <[e-mail]> wrote:
> All,
>
> FYI, we have published -00 of a draft that describes how the Salsa20
> stream cipher can be added to TLS and DTLS, see:
>
> http://tools.ietf.org/html/draft-josefsson-salsa20-tls

Hi Simon,

I am interested in this work. I am especially interested in your plan
to allow the salsa20 cipher suites to be used in TLS 1.0 and TLS
1.1, which you stated in the first paragraph of the Introduction
section.

Since all of the new cipher suite names end in _SHA256, I
infer the MAC algorithm is hmac_sha256. (The fact is
not explicitly stated in the -00 draft.) It is important to
clarify how hmac_sha256 can be used in TLS 1.0 and
TLS 1.1, because a naive implementor would see the old
definition of MACAlgorithm in TLS 1.0 and 1.1:

    enum { null, md5, sha } MACAlgorithm;

and conclude that hmac_sha256 can't be used in TLS
1.0 and 1.1.

I'm also interested in figuring out if these cipher suites
can be used in SSL 3.0. The only difficulty I see is
extending the SSL 3.0 MAC algorithm to hash=sha256
(see the definition of the SSL 3.0 MAC in Section 5.2.3.1
of RFC 6101) -- it is not clear what should be the size of
pad_1 and pad_2 for hash=sha256.

The reason I'm interested in SSL 3.0 is that web browsers,
when talking to Google servers, which implement TLS/SSL
version negotiation correctly, are still downgraded to SSL 3.0
by network errors injected by certain network devices.

Wan-Teh