Re: [TLS] Consensus Call on MTI Algorithms

On Wed, Apr 1, 2015 at 11:12 AM, Joseph Salowey <joe@salowey.net> wrote:
> We did not get a chance to talk about MTI algorithms in Dallas, but the
> chairs would like to judge consensus for the algorithms discussed in the
> interim.  The CFRG has closed or will close soon on ChaCha20 and curve 25519
> recommendations so they are included.  We will be calling for acceptance to
> bring drafts on these into the working group shortly.
>
> Keep in mind that mandatory to implement (MTI) is not mandatory to use and
> that it is expected that there will be profiles for specific environments.
>
> Below is the proposed algorithm list that had consensus at the Seattle
> Interim. Please reply on the TLS mailing list indicating whether or not you
> agree with the consensus.  If not, please indicate why.  This consensus call
> will close on April, 23, 2015.
>
> o Symmetric:
>         MUST AES-GCM 128
>         SHOULD ChaCha20-Poly1305
>
> o Hash:
>         MUST SHA-256
>
> o Key Agreement: ECDH
>         MUST P-256
>         SHOULD 25519
>
> o Signature:
>         MUST ECDSA P-256
>         MUST RSA
>
> Thanks,
>
> J&S

I disagree with this consensus. Many devices have hardware accelerated
AES, but not GCM. As it stands we don't have an efficient performer on
these devices: AES+HMAC is probably the best option on these devices.

I also don't like the idea of making non-interoperable profiles for
different environments.

Sincerely,
Watson Ladd
>
> _______________________________________________
> TLS mailing list
> TLS@ietf.org
> https://www.ietf.org/mailman/listinfo/tls
>

-- 
"Those who would give up Essential Liberty to purchase a little
Temporary Safety deserve neither  Liberty nor Safety."
-- Benjamin Franklin