Re: [TLS] Consensus Call on MTI Algorithms

[Nico Williams <[e-mail]>]

On Wed, Apr 01, 2015 at 11:12:19AM -0700, Joseph Salowey wrote:
> [...]

I'd like to have at least two required algorithms for each class, at
least for the 128-bit security level.  The rationale is: to make it easy
to switch one off if it becomes a problem.

We've already had to disable broken algorithms in a hurry in several
Internet protocols including TLS.  We should learn the lesson: we should
aim to have at least one left.

In all cases recall that required-to-implement != required-to-enable.

> o Symmetric:
>         MUST AES-GCM 128
>         SHOULD ChaCha20-Poly1305

I would like at least two modes for AES to be required: one AEAD
(probably GCM) and one AEAD-by-generic-construction (e.g., using HMAC).

I would like one non-AES cipher to be required.  ChaCha20-Poly1305 works
for me.

Total: three required algorithms.  Here I want three because I'm not
sure that GCM is easy enough to implement and use safely in all
environments (see Watson L.'s comments on this), and because I'd like
two ciphers just in case.

> o Hash:
>         MUST SHA-256

I would like two hash functions to be required.  I don't have a strong
preference as to the second hash function, but I like SHA-3.

> o Key Agreement: ECDH
>         MUST P-256
>         SHOULD 25519

By the rationale above I would like both of these to be required.

> o Signature:
>         MUST ECDSA P-256
>         MUST RSA

Ditto.  We won't have the luxury of waiting until CFRG blesses an ECC
signature scheme other than ECDSA, but when they do... we should add
that to the list.

Nico
--