[TLS] tales from the TLS interim: TLS 1.3 MTI algorithms

[Sean Turner <[e-mail]>]

All,

This message summarizes the TLS 1.3 MTI (mandatory to implement) discussions we had at the Seattle TLS Interim meeting.  We’ll also be discussing this in Dallas so this is just an FYI message.

A couple of things to keep in mind:

1. Anything in [] is predicated on the CFRG proceeding on their current course.  In other words, we are not telling the CFRG these are what we want we’re just trying to read the tea leaves.

2. We fully expect that there will be profiles for specific environments.

3. MTI is not mandatory to use.


o Symmetric:
	MUST AES-GCM 128
	[SHOULD ChaCha20-Poly1305]

o Hash:
	MUST SHA-256

o Key Agreement: ECDH
	MUST P-256
	[SHOULD 25519]

o Signature:
	MUST ECDSA P-256
	MUST RSA

On a related note, we also discussed which curves to keep in the base specification; when text from RFC 4492 was incorporated it included ~25 curves.  The code points will still exist they just won’t be in the base spec.  The 4492-list would be pruned to P-256 and  P-384 and then obviously expanded to add [25519] and [448].

spt