Re: [TLS] Consensus Call on MTI Algorithms

[Nico Williams <[e-mail]>]

On Thu, Apr 02, 2015 at 01:48:07PM +0100, Stephen Farrell wrote:
> >> On 1 April 2015 at 17:46, Yaron Sheffer <[e-mail]> wrote:
> >>> AES-256-GCM and SHA-384. Doesn't it make sense to have them as SHOULD,
> >>
> >> I don't see much point.  All involved likely know if they need
> >> something that strong, which is way down there in the "we might need
> >> it someday" category [1].
> >>
> >> [1] http://www.keylength.com/en/3/
> >>
> > 
> > The TLS BCP is IETF consensus, not just one person's opinion. If people
> > deploy stuff based on our recommendations, we should ensure that it is
> > still available to them when they migrate to TLS 1.3.
> 
> But isn't it likely we revise the TLS BCP once TLS1.3 is done and
> implementations start to become common? We can make sure things
> all add up at that point in time, and are in-whack with what people
> are deploying, but we don't necessarily need to do so now I think.

First, there will be no flag day.  Operators will need implementations
that support TLS 1.1 and 1.2 for a while yet.  So they should get
support for ciphersuites that used to be recommended.

Second, these are symmetric ciphers we're talking about.  Switching from
one set in 1.1 and 1.2 on the one hand, and 1.3 on the other, is an
operational non-issue.  Deprecating RSA, say, would be a much bigger
deal operationally.

Nico
--