Re: [TLS] I-D Action: draft-ietf-tls-chacha20-poly1305-00.txt

[Simon Josefsson <[e-mail]>]

Viktor Dukhovni <[e-mail]> writes:

> On Sun, Jun 14, 2015 at 02:17:29PM +0200, Simon Josefsson wrote:
>
>> > After discussion earlier involving ECDHE_anon cipher suites, it
>> > occurred to me that it could be useful to define one for ChaChaPoly in
>> > this draft.
>> >
>> > Is it viable to add a cipher suite name and codepoint for this?
>> 
>> What is the use-case?
>
> 0.   Authentication other than via certificate-based PKI.  Establish
>      anon TLS, and channel-bind the TLS-unique via GSSAPI or some
>      other authentication method.
>
> 1.  Unauthenticated opportunistic TLS.
>
>     * Server performs no unnecessary signature operations,
>       since the client can't verify the signature anyway.
>       (More precisely the client can't verify the authenticity
>       of the server keys, so it can only determine that somebody
>       signed the handshake, but no idea whether it is the intended
>       server).

Both those use-cases can be achieved by chosing, say, ECDHE_ECDSA and
not verify the signature, right?

>     * Servers can tell which clients are not verifying their
>       identity, (definitely the ones the offer or negotiate "anon"
>       ciphersuites).  This is useful information.

I don't think you can necessarily infer that from what a client offers.
It may behave differently depending on which ciphersuite is chosen.

However, maybe we can do:

  TLS_ECDHE_anon_WITH_CHACHA20_POLY1305 = {0xTBD, 0xTBD} {0xCC, 0xA4}

I'd appreciate if others could weigh in their opinion on whether more
ECDHE_anon ciphersuites are important or not.

/Simon