Re: [TLS] ChaCha20 + Poly1305 in TLS

[[e-mail] (Martin Rex)]

Adam Langley wrote:
>
> > Which versions of TLS is this aimed at, TLS 1.2 (and later) only or earlier
> > versions too?
> 
> Since it's defined as an AEAD, technically it's only compatible with
> TLS 1.2 - same as AES-GCM.
> 
> However, the reality, at least for browsers, is that we cannot depend
> on TLS's version negotiation because of bugs in servers. Therefore, in
> practice, I'm planning on making some or all AES-GCM and
> Chacha20-Poly1305 ciphersuites work for all versions. For SSLv3,
> ECDHE/ECDSA variants will implicitly indicate support for
> P-{256,384,521} and uncompressed points since SSLv3 cannot carry the
> EC extensions needed to indicate that.

Only those incarnations of SSLv3 that are "TLS extensions intolerant"
can not carry TLS extensions.  For all other implementations of SSLv3
(i.e. those based on the ssl302 draft that became rfc6101), support
for TLS extensions is no different from what it is in TLSv1.0 onward.

-Martin