Re: [TLS] Inclusion of OCB mode in TLS 1.3

[Nico Williams <[e-mail]>]

On Wed, Jan 21, 2015 at 08:15:45AM -0800, Eric Rescorla wrote:
> On Wed, Jan 21, 2015 at 7:17 AM, Aaron Zauner <[e-mail]> wrote:
> > Any comments on the idea of removing the following two ciphersuites from
> > the draft?
> >
> >      CipherSuite TLS_DHE_PSK_WITH_AES_128_OCB = {TBD9, TBD9}
> >      CipherSuite TLS_DHE_PSK_WITH_AES_256_OCB = {TBD10, TBD10}
> >
> > I don't see how these would be relevant to embedded devices.

If DHE_PSK is relevant to an embedded device then all cipher+mode
combinations might be as well.  Obviously OCB wouldn't be required to
implement, but that's no reason to exclude any one subset of ciphersuits
using OCB.

> If we generally think DHE_PSK is a good idea, is there a specific
> reason why it wouldn't be a good idea for OCB?

There isn't.  Embedded devices need not implement the full set of
suites.

But really, this is once more about the gross inefficiency (in terms of
registration as well as number of bytes used on the wire) of cartesian
explosion ciphersuites.  Can we fix this?

Nico
--