Re: [TLS] Confirming Consensus on supporting only AEAD ciphers

[Eric Rescorla <[e-mail]>]

On Fri, Mar 28, 2014 at 2:14 AM, Nikos Mavrogiannopoulos <[e-mail]>wrote:

> On Fri, 2014-03-28 at 04:42 +0000, Joseph Salowey (jsalowey) wrote:
>
> > >> Please look at RFC 6476.  In that document, Peter Gutmann uses
> traditional
> > >> encryption and integrity functions to make an AEAD cipher.  Does this
> > >> decision allow or prohibit such ciphers?
> > >
> > > I had a similar question, the EtM draft uses the existing CBC as part
> of an
> > > AEAD mechanism, in a manner that requires minimal changes and no
> > > implementation of new cipher modes.  Does that count as AEAD, or does
> it have
> > > to be a combined cipher mode?
> > [Joe] I don't think it counts as an AEAD mechanism.  It is not using the
> AEAD  cipher type defined in RFC 5246.   You could define EtM using CBC so
> that it fits the AEAD interface.
>
> I don't think this is possible. Don't forget that the AEAD mechanism in
> TLS is only applicable to stream ciphers, i.e, for ciphers that
> plaintext equals ciphertext. So moving everything to "AEAD" would have
> to create a new AEAD mode.
>

This is fairly straightforward to address by simply adopting
the same length approach that Peter's draft adopts. Yes, we
would need to update the text, but since we're talking about
a new document that doesn't seem like a problem.


Overall, I think that this discussion about allowing only the true
> "AEAD" is pointless. All TLS ciphersuites are Authenticated Encryption
> by definition and there is no advantage by require them to fit into the
> TLS true "AEAD" mode.
>

The idea here is that TLS currently specifies *in TLS* how to compose
authentication and encryption which means that we have to specify
three interfaces for three different kinds of ciphers (stream, block, AEAD).
Since cryptographic practice seems to be moving towards AEAD as
a primitive, we have an opportunity to simplify matters by going to
an AEAD only interface which also has the virtue of having to specify
specific constructions in TLS.

-Ekr