Re: [TLS] A la carte handshake negotiation

[Nico Williams <[e-mail]>]

On Thu, Jun 11, 2015 at 03:58:21PM -0400, Dave Garrett wrote:
> Here is a branch with a rough draft of an a la carte handshake
> algorithm negotiation scheme for TLS 1.3, based on discussions on this
> list.

Commenting on the latest update of that:

> https://github.com/davegarrett/tls13-spec/compare/updateciphersuites...davegarrett:alacarte

 - Yes!  This.

 - IMO the hash should be associated with the "handshake portion" of a
   cipher suite, not the bulk side.

   Ideally it'd be:

      Hash_Algs x KE_groups x Server_auth_algs x Bulk_cipher_and_mode

   That's four registries instead of one or two.

   I'll settle for your proposal though!

 - It'd be nice if instead of always thinking of authentication as
   "signatures" we just thought of it as authentication.

   Consider authentication by using a DH cert...  If that's selected
   then the handshake won't be the usual one that we're all used to, but
   it would be workable.

 - Anon ciphersuites...

   I'd much rather that the WG did NOT deprecate these!

   For opportunistic security and channel binding applications anon
   ciphersuites are just fine, and the alternatives are wasteful (e.g.,
   doing signatures that aren't needed).

   Recommending against the use of anon ciphersuites is and should be a
   job for UTA.

Nico
--