Re: [TLS] adopting ChaCha20 as a WG item was: I-D Action: draft-ietf-tls-prohibiting-rc4-01.txt

[Yoav Nir <[e-mail]>]

On Oct 2, 2014, at 4:19 PM, Nikos Mavrogiannopoulos <[e-mail]> wrote:

> On Thu, 2014-10-02 at 15:58 +0300, Yoav Nir wrote:
>> Hi, Nikos
>> 
>> I think yes, especially considering that CFRG has just started RGLC on
>> the document.
>> 
>> I think it’s debatable whether we need so many ciphersuites.
>> Considering that TLS 1.3 will be PFS-only and AEAD-only, I’m not sure
>> we need the ciphersuites in section 4.1, and the RSA (without DHE)
>> ciphersuites. The feedback I got in IPsecME was that we didn’t need
>> anything but the AEAD. But that kind of thing can be debated in the
>> working group.
> 
> Hello Yaov,
> I agree. The non-AEAD ciphersuites are in order to be implementable to
> pre-TLS 1.2. Whether they are applicable to TLS 1.3 or not, is outside
> the scope of this document.
> 

HI Nikos

A pre-1.2 implementation of ChaCha20 assumes that there are libraries out there that on the one hand don’t have TLS 1.2, and on the other hand are still actively developed enough that they will implement a new algorithm.

I don’t think that’s the case. If ChaCha20-Poly1305 is going to be implemented in OpenSSL, it’s going to be in 1.0.1 or 1.0.2. I don’t think anyone’s going to add it to 0.9,8, where every recent patch has been a security hotfix.

Similarly, every library I know of that is being maintained already has TLS 1.2.  I don’t feel strongly about it, but I don’t see the use of having new non-AEAD ciphers at this point.

Yoav