Re: [TLS] EXTERNAL: Re: integrity only ciphersuites

Hi Eric,

Thanks for your feedback.  Just a few points to add:

1. There really are some applications where confidentiality isn’t important, for example some motion control that might involve very simple move instructions (e.g. go to X, go to Y, go to Z, repeat).  Certainly there are also applications that would benefit from confidentiality, but there’s a non-trivial amount that really gain little to nothing.
2. In some cases the code size is quite important.  It’s not uncommon for hardware to be in the field in Industrial Automation for 15 or more years, so in some cases the hardware is already stretched pretty thin and might not be able to handle the demands of encryption.  At the same time it is hugely beneficial to take advantage of the security of TLS for many of these installations.
3. Another use case for these NULL encryption suites is around inspection of data.  I think this has been discussed in this forum already, but these cipher suites could support that as well.

Thanks and Best Regards,

Jack Visoky
Security Architect and Sr. Project Engineer
Common Architecture and Technology Group
Rockwell Automation | 1 Allen-Bradley Drive | Mayfield Heights, OH 44124

From: TLS [mailto:tls-bounces@ietf.org] On Behalf Of Eric Rescorla
Sent: Monday, August 20, 2018 4:58 PM
To: Nancy Cam-Winget (ncamwing) <ncamwing=40cisco.com@dmarc.ietf.org>
Cc: tls@ietf.org
Subject: EXTERNAL: Re: [TLS] integrity only ciphersuites

[Use caution with links & attachments]

On Mon, Aug 20, 2018 at 1:48 PM, Nancy Cam-Winget (ncamwing) <ncamwing=40cisco.com@dmarc.ietf.org> wrote:
All,
A couple IoT consortiums are trying to embrace the improvements made to TLS 1.3 and as they define their new security constructs would like to adopt the latest protocols, in this case TLS 1.3.   To that extent, they have a strong need for mutual authentication, but integrity only (no confidentiality) requirements.  

In following the new IANA rules, we have posted the draft https://tools.ietf.org/html/draft-camwinget-tls-ts13-macciphersuites-00 to document request for registrations of HMAC based cipher selections with TLS 1.3…..and are soliciting feedback from the WG on the draft and its path forward.

Nancy,

As you say, you don't need WG approval for code point registration as long as you don't want Recommended status.

With that said, I don't think this document makes a very strong case for these cipher suites. Essentially you say:

1. We don't need confidentiality
2. Code footprint is important

Generally, I'm not very enthusiastic about argument (1). It's often the case that applications superficially need integrity but actually rely on confidentiality in some way (the obvious case is that HTTP Cookies are an authentication mechanism, but because they are a bearer token, you actually need confidentiatilty). It's much easier to just always supply confidentiality than to try to reason about when it is or is not needed.

The second argument is that you are trying to keep code size down. It's true that not having AES is cheaper than having AES, but it's possible to have very lightweight AES stacks (see for instance: https://github.com/01org/tinycrypt).

So, overall, this doesn't seem very compelling..

-Ekr

Warm regards, Nancy (and Jack)

_______________________________________________
TLS mailing list
TLS@ietf.org
https://www.ietf.org/mailman/listinfo/tls