Re: [TLS] TLS1.2 vs TLS1.0

[Geoffrey Keating <[e-mail]>]

Ulrich Herberg <[e-mail]> writes:

> Is there any recommendation in which cases the use of CBC ciphersuites
> would actually cause any (practical) risk so that we can evaluate
> whether we should use alternatives to CBC like AEAD?

I believe you'd need to very carefully evaluate the entire system you
would plan to use the CBC ciphersuites for applicability of known
attacks such as:

- The issue fixed in TLS 1.1, use of a predictable IV
- The timing issue(s) discussed in the "Lucky Thirteen" paper
- Information disclosure due to use of compression

Each of these may or may not apply to a particular system or
implementation.  For example, timing issues can be a big problem if
you have small embedded devices---or no problem at all because
communication always happens at particular scheduled times and the
messages are prepared earlier.

> Is current support for AEAD cipher suites in common TLS1.2
> implementations as good as for CBC cipher suites?

No, alas.  But it's pretty good and getting better.

> Is there any drawback for using AEAD ciphers?

Not that I know of.

> Is there any sort of best practice or similar document where
> a user designing an application can make a choice which TLS version /
> cipher suites to use?

I think any situation that forces you to use earlier versions of TLS
or cipher suites that aren't AEAD is pushing you out of "best
practice" and into the jungle of "whatever needs to happen to make this
work".