Re: [TLS] draft-kato-tls-rfc4132bis-03

[Alfred Hönes <[e-mail]>]

Since the first revisions of draft-kato-tls-rfc4132bis,
the collective wisdom in the TLS WG, the SEC area of the IETF,
and at large, on proper mix & match of block cipher strenghts
(measured in key size) and hash strength (measured in SHA-2
hash width) has evolved.

The latest policy of the TLS WG was:

a) that full AES-256 strength (corresponding to SHA-512)
   was not required in TLS for the foreseeable future, and

a) to use the 'overshooting' AES-256 for the 192-bit security
   level (corresponding to SHA-384), in order to reduce the
   combinatorial complexity.

Based on these principles, the common combinations have been
   AES-128 + SHA-256     and    AES-256 + SHA-384 .

This strategy has been followed in the TLS ciphersuite documents
published in the recent past and currently in the RFC Editor Queue.

Thus, it should be seriously considered to define a matching
portfolio of properties in the Camellia-based family of TLS
cipersuites.

This would mean introducing SHA-384 in place of SHA-256 into
the last group of 6 ciphersuites (those using Camellia-256)
defined in the draft.

Should we recommend the authors to undertake this step?


Kind regards,
  Alfred.

-- 

+------------------------+--------------------------------------------+
| TR-Sys Alfred Hoenes   |  Alfred Hoenes   Dipl.-Math., Dipl.-Phys.  |
| Gerlinger Strasse 12   |  Phone: [phone], Fax: -18         |
| D-71254  Ditzingen     |  E-Mail:  [e-mail]                     |
+------------------------+--------------------------------------------+