Re: [TLS] DSA should die

[Ilari Liusvaara <[e-mail]>]

On Thu, Apr 02, 2015 at 11:45:35AM -0500, Nico Williams wrote:
> On Thu, Apr 2, 2015 at 2:39 AM, CodesInChaos <[e-mail]> wrote:
> > Nico Williams [e-mail] wrote:
> >> Yes, we could patch in a-la-carte ciphersuite negotiation by having
> >> non-functional ciphersuites that wild-card all but the one kind of
> >> thing.  You offer those.  A matching functional ciphersuite gets
> >> selected.  Done.
> >>
> >> TLS_*_*_WITH_AES_GCM_*
> >> TLS_*_*_WITH_*_*_SHA384
> >> TLS_ECDHE_*_WITH_*_*_*
> >> ...
> >
> > I think full a-la-carte is too complex. But I'm for negotiating the
> > handshake and symmetric crypto separately. They're already very
> > loosely coupled and most proposals that introduce/obsolete
> > ciphersuites are only interested in one of the two sides, with the
> > other being only an afterthought.
> 
> That would be a huge improvement over what we have now.

I say if one splits symmetric/asymmetric, then the hash should go
to the asymmetric part, since it is used there.

And furthermore, since there are group and cert type negotiation
mechanism already can do unified DH/w certs.

So (with some added in):

TLS13_A_DH_CERT_SHA256
TLS13_A_DH_CERT_SHA384
TLS13_S_AES_128_GCM
TLS13_S_AES_256_GCM
TLS13_S_ARIA_128_GCM
TLS13_S_ARIA_256_GCM
TLS13_S_CAMELLIA_128_GCM
TLS13_S_CAMELLIA_256_GCM
TLS13_S_AES_128_CCM
TLS13_S_AES_256_CCM
TLS13_S_AES_128_CCM8
TLS13_S_AES_256_CCM8
TLS13_S_CHACHA20_POLY1305

(I included a cipher if it had an existing codepoint or
was in wide use and was TLS 1.3 compatible).

I'm on fence about splitting hash out:

TLS13_A_DH_CERT
TLS13_H_SHA256
TLS13_H_SHA384
TLS13_S_*

As it seems to me that symmetric algorithm, key exchange and
hash to use are relatively independent concerns (I know gnutls
has internal mapping table that breaks ciphersuites to internal
component parts).

Regarding ServerHello parts of this, the ServerHello could be
redesigned, except for the version field, which is convinently
the first.

So one could put two or three ciphersuite fields, one for
each type there.


If one wanted to add anonDH and PSK:

TLS13_A_DH_ANON
TLS13_A_DH_PSK
TLS13_A_PSK

Giving 17 ciphers that span cartesian space of 88 cipher-
suites.


-Ilari