Re: [TLS] Salsa20 and Poly1305 in TLS

[Nick Mathewson <[e-mail]>]

On Mon, Jul 29, 2013 at 3:09 PM, Adam Langley <[e-mail]> wrote:
> I cannot make it to Berlin I'm afraid (or, indeed, any meetings until
> at least IETF 91) so I'm writing my thoughts on
> draft-josefsson-salsa20-tls-02, which is scheduled for discussion.
>
> We (Google) support the addition of Salsa20 as a cipher in TLS. Having
> a secure cipher which is fast and constant time on all platforms is
> important. It's also good to have an alternative to AES in the wings
> should that be needed in the future. At the moment I consider RC4 and
> AES-CBC to be mortally wounded, even if we have to continue supporting
> them for many years yet.

Hi!  Nick Mathewson (Tor guy) here.

We at Tor also support adding Salsa20 as a TLS ciphersuite, for about
the same reasons as Adam.  (We won't be able to start using it much
till browsers start using it, of course, since it's not in our
interest to be among the first adopters of any externally detectable
TLS feature.)

I also personally concur with Adam's arguments in favor of Poly1305,
but UMAC wouldn't be a disaster.

best wishes,
-- 
Nick Mathewson