[TLS] Question about TLS_RSA_WITH_3DES_EDE_CBC_SHA

[Stefan Winter <[e-mail]>]

Hello,

in radiusext, I need to make an assessment whether an I-D is compliant to a crypto-agility requirements document.

The draft (still) requires at least TLS 1.1 with its mandatory-to-implemnt cipher suite TLS_RSA_WITH_3DES_EDE_CBC_SHA.

The crypto-agility document requires the mandatory-to-implement algorithm to be NIST approved, "Acceptable with no deprecation date" in NIST SP-800-131A. 

That document marks 
* two-key Triple DES Encryption as an encryption with deprecation date
* three-key Triple DES Encryption as an encryption without deprecation date

I'm not sure whether TLS_RSA_WITH_3DES_EDE_CBC_SHA is a two-key or a three-key 3DES algorithm. This condition would be the only one that could downgrade the I-D in question from "unconditionally compliant" to "conditionally compliant".

So... would anybody have some insight which of the variant(s) is/are used in TLS_RSA_WITH_3DES_EDE_CBC_SHA?

Greetings,

Stefan Winter


-- 
Stefan WINTER
Ingenieur de Recherche
Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche
6, rue Richard Coudenhove-Kalergi
L-1359 Luxembourg

Tel: [phone]
Fax: [phone]