Re: [TLS] Confirming Consensus on supporting only AEAD ciphers

On Tue, Apr 29, 2014 at 8:55 AM, Peter Gutmann
<pgut001@cs.auckland.ac.nz> wrote:
> Fedor Brunner <fedor.brunner@azet.sk> writes:
>
>>The Mandatory Cipher Suite for TLS 1.2 was TLS_RSA_WITH_AES_128_CBC_SHA. What
>>is the mandatory cipher in TLS 1.3 ? Maybe
>>TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 using Curve25519 for ECDHE ?
>
> Ugh, no.  That takes the ciphers from <industry-standard>+<industry-standard>
> +<industry-standard> to <oddball-nonstandard>+<oddball-nonstandard>+<oddball-
> nonstandard>+<industry-standard>.  Make the defaults something that can be
> implemented with a standard crypto library, and leave the oddball stuff as
> optional fashion statements.
>
> (No disrespect intended for the algorithms I've designated as "oddball", but I
> want something where the default is built from standard, accepted, widely-
> recognised algorithms so I don't have to explain to every customer what
> ChaCha20 is and why it's being used to protect their banking transactions).

Well, Vanguard uses RC4. That said I think
TLS_ECDHE_RSA_AES_GCM_SHA256 with P256 as ECDHE is implemented widely,
and pretty secure. Yes, there is a performance gain from Curve25519,
but that's not necessary.

Sincerely,
Watson Ladd

>
> Peter.
> _______________________________________________
> TLS mailing list
> TLS@ietf.org
> https://www.ietf.org/mailman/listinfo/tls

-- 
"Those who would give up Essential Liberty to purchase a little
Temporary Safety deserve neither  Liberty nor Safety."
-- Benjamin Franklin