Re: [TLS] chacha to replace RC4 (was: Salsa vs. ChaCha)

[Nikos Mavrogiannopoulos <[e-mail]>]

On Fri, 2013-12-06 at 19:44 -0800, Brian Smith wrote:

> AFAICT, there's no technical reason to prohibit AEAD in TLS 1.0 or TLS
> 1.1.
> 
> Also, I don't think TLS 1.2 is that much code to add to a TLS 1.0 or
> TLS 1.1 implementation, especially if you're not supporting any new
> cipher suites except the new ChaCha20 ones, and if you're not trying to
> support any functionality above what what TLS 1.0 and TLS 1.1 provide.
> Consequently, I don't think we should consider the AEAD construction to
> be too much of a burden for anybody to implement in order to support
> new cipher suites.

Hello,  
 I agree that there is no technical reason to prohibit AEAD in
TLS 1.x, x<2, but exactly for this prohibition, the old non-TLS 1.2
supporting implementations don't have support for AEAD. Their design is
often agile in the sense that a new cipher or MAC can be easily added,
but adding an AEAD cipher there is a non-trivial matter. If by AEAD you
mean Adam's draft, then there is also the question why replace
RC4-HMAC-SHA1 with AEAD-CHACHA-POLY1305 when you only need to fix RC4?
(and we have no reasons to believe that HMAC-SHA1 is broken).

If you suggestion is to make CHACHA-HMAC-SHA1 an AEAD design, I don't
think that this is needed. Unlike AEAD-CHACHA-POLY1305 which is
inherently an AEAD design, there is no advantage gained by making
CHACHA-HMAC-SHA1 an AEAD cipher - except for saying "cool it is AEAD",
and making it more difficult for old implementations to use it.

regards, 
Nikos