Re: [TLS] Call for WG adoption of draft-mattsson-tls-ecdhe-psk-aead

[Nikos Mavrogiannopoulos <[e-mail]>]

On Mon, 2016-04-25 at 08:17 -0700, Sean Turner wrote:
> All,
> 
> draft-mattsson-tls-ecdhe-psk-aead includes some cipher suites that
> are needed for TLS1.3.  We need to get these officially registered so
> the chairs would like to hear whether there is WG support for
> adopting draft-mattsson-tls-ecdhe-psk-aead. Please let us know
> whether you:

I support this draft. However see comment below.

The text: "For the AES-128 cipher suites, the TLS Pseudorandom Function
(PRF) with SHA-256 as the hash function SHALL be used and Clients and
Servers MUST NOT negotiate curves of less than 255 bits." is very
tricky.

Implementations do not restrict ciphersuites based on curves (there is
no such notion in TLS, nor mentioned in rfc4492), and I cannot even
think how a TLS handshake implementation would look like if each
different ciphersuite has specific curve requirements.

Note that this requirement is unlike the suiteB RFC (rfc6460) that also
restricts the curves. SuiteB specifies a profile/set of parameters
which include ciphersuites, while this draft only defines ciphersuite
code points.

If a side goal of this draft is to deprecate the <255 bit elliptic
curves from TLS 1.2, or to unify security levels across ciphersuites
then I'd recommend to do that with a separate RFC rather than bundling
it into a code-point assignment RFC.

regards,
Nikos