Re: [TLS] EXTERNAL: Re: integrity only ciphersuites

["Blumenthal, Uri - 0553 - MITLL" <[e-mail]>]

No they should not be recommended (as a typical TLS use case includes confidentiality requirement).

Yes this WG should review them and make a security statement, e.g., like "we reviewed these suites and found that they do provide authentication and integrity protection. No other protection such as confidentiality is provided" (as should be obvious from their names).

I suspect the authors are looking for code point assignment and general approval here, but they can speak for themselves. ;-)

Regards,
Uri

Sent from my iPhone

> On Aug 21, 2018, at 14:20, Eric Rescorla <[e-mail]> wrote:
> 
> 
> 
>> On Tue, Aug 21, 2018 at 11:11 AM, Viktor Dukhovni <[e-mail]> wrote:
>> 
>> 
>> > On Aug 21, 2018, at 1:29 PM, Ted Lemon <[e-mail]> wrote:
>> > 
>> >   You're going to have to change what you do anyway—rather than arguing with us why not bypass us entirely?
>> 
>> TLS is not just a WWW protocol.  Other transport security use-cases
>> should not have to justify their existence.
>> 
>> It is, of course, appropriate to make sure that proposed TLS code-points
>> that cater to specialized needs are well thought out and include
>> suitable security considerations.
>> 
>> It is also reasonable to check that the requirements are not already
>> met without the proposed code-points.
>> 
>> I am concerned that we are going beyond that to questioning the
>> legitimacy of the use-cases.  IPsec is rarely a practical alternative
>> to TLS.
>> 
>> That said, TLS-LTS (a TLS 1.2 profile) may well be a good long-term
>> choice where TLS 1.3 is not sufficiently compatible.
>> 
>> As for TLS 1.3, it is indeed missing both null encryption and null
>> authentication ciphers. 
> 
> If by "null authentication" you mean "without certificates", then TLS 1.3 does
> support these via RFC 7250. See:
> 
> https://tools.ietf.org/rfcmarkup?doc=8446#appendix-C.5
> 
> 
>> This is not to say that null encryption ciphers for TLS 1.3 are
>> unconditionally good, their specification would need to provide
>> sound security considerations and be fit for purpose.  But I do
>> think that we should not reject the proposal out of hand.
> 
> This isn't a matter of rejecting or accepting them. As I said at the beginning of
> this thread. No TLS WG approval is required to get a code point.
> 
> The relevant questions are:
> 
> 1. Should they be marked "Recommended" in the registry?
> 2. Should the TLS WG spend time reviewing these documents?
> 
> Can the authors of this draft please say what they are looking for here?
> 
> -Ekr
> 
> 
>> 
>> -- 
>> -- 
>>         Viktor.
>> 
>> _______________________________________________
>> TLS mailing list
>> [e-mail]
>> https://www.ietf.org/mailman/listinfo/tls
> 
> _______________________________________________
> TLS mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/tls