Re: [TLS] Consensus Call on MTI Algorithms

Peter Gutmann <> Fri, 03 April 2015 08:52 UTC

Return-Path: <>
Received: from localhost ( []) by (Postfix) with ESMTP id 82D0C1A1AB8 for <>; Fri, 3 Apr 2015 01:52:15 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -3.91
X-Spam-Status: No, score=-3.91 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, MIME_8BIT_HEADER=0.3, RCVD_IN_DNSWL_MED=-2.3, T_RP_MATCHES_RCVD=-0.01] autolearn=ham
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id j9H5qOndp_dw for <>; Fri, 3 Apr 2015 01:52:13 -0700 (PDT)
Received: from ( []) (using TLSv1 with cipher RC4-SHA (128/128 bits)) (No client certificate requested) by (Postfix) with ESMTPS id 8DB6E1A1AC1 for <>; Fri, 3 Apr 2015 01:52:12 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple;;; q=dns/txt; s=uoa; t=1428051133; x=1459587133; h=from:to:subject:date:message-id:references:in-reply-to: content-transfer-encoding:mime-version; bh=iPKT04dqOfFAauaAtgN2QFuQIbFtrMtGCf+fxtj7yMs=; b=UMhnG0Aw8yhHsyKbA1/fX3i21f5pBzXfXZ0fMxpPEz8/CDI3K+y2trCW +W/l+Xv+Mkg2LnrbM3DkTWkQKvfkhA1X4VxTPb60z0gB58AtgMb8oOGRi y53yLaRdIWVlUpidVMuT0wSdH3Qsj9cIzp0Jf1NXEh5wDWNGLPQB2rMT+ s=;
X-IronPort-AV: E=Sophos;i="5.11,516,1422874800"; d="scan'208";a="318818677"
X-Ironport-Source: - Outgoing - Outgoing
Received: from ([]) by with ESMTP/TLS/AES128-SHA; 03 Apr 2015 21:52:12 +1300
Received: from ([]) by ([]) with mapi id 14.03.0174.001; Fri, 3 Apr 2015 21:52:10 +1300
From: Peter Gutmann <>
To: Hanno Böck <>, "" <>
Thread-Topic: [TLS] Consensus Call on MTI Algorithms
Thread-Index: AQHQbKeDwNeK1AEgwEC7Z+eGtfd7J505HmiAgAHfApk=
Date: Fri, 03 Apr 2015 08:52:10 +0000
Message-ID: <>
References: <>, <>
In-Reply-To: <>
Accept-Language: en-NZ, en-GB, en-US
Content-Language: en-NZ
x-originating-ip: []
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
Archived-At: <>
Subject: Re: [TLS] Consensus Call on MTI Algorithms
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Fri, 03 Apr 2015 08:52:15 -0000

Hanno =?UTF-8?B?QsO2Y2s=?= <> writes:

>Other options: AES-CBC with EtM (Peter Gutmann just claimed here he thinks
>its less brittle than GCM) or other block modes (OCB?).

I've always liked OCB, and the removal of encumbrance for TLS implementations
finally makes it available for use there.  GCM is just too brittle, a minor
implementation flaw (as has already occurred in things like tarsnap and JCE)
leads to a complete loss of security, while the same flaw using CBC (and
presumably OCB) leads to mostly theoretical weaknesses.  GCM (or at least its
underlying primitive, CTR) is RC4 all over again, and we're already seeing
some of the same mistakes that killed RC4 use appearing in GCM deployments.