Re: [TLS] Consensus Call on MTI Algorithms

[Yoav Nir <[e-mail]>]

> On Apr 2, 2015, at 9:36 PM, Nico Williams <[e-mail]> wrote:
> 
> On Thu, Apr 02, 2015 at 05:52:36AM -0700, Yaron Sheffer wrote:
>> On 04/02/2015 05:48 AM, Stephen Farrell wrote:
>>> But isn't it likely we revise the TLS BCP once TLS1.3 is done and
>>> implementations start to become common? We can make sure things
>>> all add up at that point in time, and are in-whack with what people
>>> are deploying, but we don't necessarily need to do so now I think.
>> 
>> It entirely likely. But even then, I am not sure we'll be able to
>> convince people who went to AES-256 (presumably, for "compliance"
>> reasons) to move to ChaCha. And certainly not to AES-128...
> 
> Must-implement != must-deploy.

Hi, Nico.

That’s a nice catch-phrase, but what does it mean? Suppose I am implementing a TLS library specifically for the IoT space. Being a standards-compliant implementation, my library and all its users will of course conform to the profile in draft-ietf-dice-profile. That means TLS_PSK_WITH_AES_128_CCM_8. Given this, why must I implement AES-GCM? Why should I implement ChaCha? I and any other IoT implementer will argue that the devices don’t have the memory for code that will never run. 

Sure, if I’m writing an OpenSSL, then I can implement everything and allow users to configure whatever algorithm they want. But I really don’t get what this phrase means in this context.

Yoav