Re: [TLS] WG adoption + early code point assignment: draft-mavrogiannopoulos-chacha-tls

[Martin Thomson <[e-mail]>]

On 19 May 2015 at 14:51, Yoav Nir <[e-mail]> wrote:
> 2) I question the need for TLS_DHE_ ciphersuites, and I seriously doubt anybody’s going to use those with ChaCha20 “in the wild”. Other than that, I’m all for early assignment as it would allow us to get the algorithms into code-bases and test interoperability quicker.

I tend to agree.  Can someone reply with a brief explanation of why
each of the following is needed?  Hopefully better than what I was
able to devise:

TLS_RSA_WITH_CHACHA20_POLY1305
Because we're scared of ephemeral key exchange for some reason ?

TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305
Because ECDHE is good, and RSA is widespread.

TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305
Because this is what we actually want.

TLS_DHE_RSA_WITH_CHACHA20_POLY1305
Because we need a backup for EC.

TLS_DHE_PSK_WITH_CHACHA20_POLY1305
Because ECDHE is nice, but we need a backup, even for little things ?

TLS_PSK_WITH_CHACHA20_POLY1305
Because little things don't like paying for asymmetric crypto.

TLS_ECDHE_PSK_WITH_CHACHA20_POLY1305
Because little things need nice things too.

TLS_RSA_PSK_WITH_CHACHA20_POLY1305
Because little things like doing bignum exponentiation without any PFS
payoff, but RSA alone isn't "secure enough" ?


The thing that concerns me most is that we aren't saying that PFS is
required outside of PSK.  I understand the carve-out we've made for
the little things, but I don't understand why we are defining
RSA-based suites without PFS.

Of comparable concern is the RSA_PSK stuff.  I wasn't around for the
definition of these originally, but they make basically no sense to
me.

I get the DHE_PSK thing if you justify it using the same basis as
DHE_RSA, but it might be that the little things can just take a pass
on PFS without ECDHE.

Would it be unreasonable to cut the list to ... ?
TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305
TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305
TLS_DHE_RSA_WITH_CHACHA20_POLY1305
TLS_PSK_WITH_CHACHA20_POLY1305
TLS_ECDHE_PSK_WITH_CHACHA20_POLY1305

Also, I'm not against DHE in general, and I think that it's worth
keeping around for a little longer. However.  If we consider DHE_RSA
worth doing, then the only logic I can concoct would provide almost
equal justification for DHE_ECDSA.