Re: [TLS] ChaCha20 + Poly1305 in TLS

[Adam Langley <[e-mail]>]

On Wed, Sep 11, 2013 at 8:30 AM, Dr Stephen Henson
<[e-mail]> wrote:
> Which versions of TLS is this aimed at, TLS 1.2 (and later) only or earlier
> versions too?

Since it's defined as an AEAD, technically it's only compatible with
TLS 1.2 - same as AES-GCM.

However, the reality, at least for browsers, is that we cannot depend
on TLS's version negotiation because of bugs in servers. Therefore, in
practice, I'm planning on making some or all AES-GCM and
Chacha20-Poly1305 ciphersuites work for all versions. For SSLv3,
ECDHE/ECDSA variants will implicitly indicate support for
P-{256,384,521} and uncompressed points since SSLv3 cannot carry the
EC extensions needed to indicate that.

I don't know whether, in standards land, that will be explicit.

> Would it make sense to include some DHE ciphersuites as well as the ECDH ones
> for implementations which (for whatever reason) do not support or disable ECDH?

I would like to support only ECDHE-ECDSA at this point but RSA has
significant inertia because of the CA system. On reflection, it does
seem reasonable that some implementations might not want the weight of
an ECC implementation given that they have to have
multiplicative-modexp for RSA anyway. So I've spun version -01 with
with a DHE_RSA ciphersuite too.


Cheers

AGL