Re: [TLS] AES-OCB in TLS [New Version Notification for draft-zauner-tls-aes-ocb-03.txt]

[Jeffrey Walton <[e-mail]>]

On Mon, Jun 1, 2015 at 12:06 PM, Aaron Zauner <[e-mail]> wrote:
> Hi,
>
> Jeffrey Walton wrote:
>> What do you suggest for resource constrained devices? What are the
>> remaining choices?
>
> There're none.
>
>> When the device cannot do public key, they often use PSK.
>>
>> PSK also has two desirable properties: channel binding and mutual
>> authentication, and most other cipher suites don't provide them.
>>
>
> I agree, but am unsure to what extent they are used in real life. I'm
> trying to reduce the number of cipher-suites that would have to be added
> to the IANA TLS parameter list; since PSK is unsupported with GCM
> cipher-suites it seems only logical to exclude them here as well.
> Because I regularly receive off-list mail that PSK is indeed wanted,
> I've not yet removed those cipher-suites.

I know hoteliers are working with lock vendors on the next generation
of locks. These are the online, no-mag-and-stripe keys and locks. I
imagine PSK is going to be one of their expected choices due to
constraints.

Folks like Dr. Gutmann have use cases I am not familiar with. (or have
not yet suffered).

> RFC3268 (CBC modes) also excludes TLS-PSK ciphersuites. There seems to
> be a seperate document that deals with TLS-PSK namely RFC5487 (defines
> GCM and CBC PSK cipher-suites). It might make sense to update this
> document in case OCB mode get's accepted by the TLS-WG instead.
>
> BTW: is TLS-SRP in use anywhere?

I believe so. It looks like World of Warcraft/Blizzard uses them
(http://arstechnica.com/security/2012/08/hacked-blizzard-passwords-not-hard-to-crack/).
I also believe Cupid Media was using them
(https://news.ycombinator.com/item?id=6767152).

If PSK is going to be yanked, then there should probably be an
non-public-key PAKE alternative.

Jeff