Re: [TLS] AEAD only for TLS1.3 revisit

[Nikos Mavrogiannopoulos <[e-mail]>]

On Tue, 2014-09-30 at 18:19 -0400, Michael StJohns wrote:
> On 9/30/2014 4:28 PM, Martin Thomson wrote:
> > On 29 September 2014 09:28, Michael StJohns <[e-mail]> wrote:
> >> Question:  Is there absolutely no requirement for TLS1.3 integrity only
> >> cipher suites?
> > If you believe that integrity-only modes are valuable, you could
> > propose an AEAD formulation that does not provide confidentiality.
> > That's fairly trivial to do with an AEAD construction: just move
> > everything under the AD part.
> 
> To be a bit pedantic - that's not actually how you would do it.  TLS 
> treats the user data as non-AD data.  There is no provision in the 
> protocol for moving everything from encryption to AAD only.
> 
> You could define an AEAD cipher such as NULL_HMAC_SHA256_AEAD could work 
> if you wanted integrity only - it's too bad we can't just use the 
> existing integrity only suites.

It's not simply too bad, it is unnecessary work, and additional bloat
to implementations which will have to carry two versions of the same
ciphersuite. One that is valid for TLS 1.2 and prior, and another that
will be valid for TLS 1.3 and later. Since SSL 3.0 is yet still in use
we can expect this duplication (of code and bugs) to last at least 15
years. The benefit of this duplication is some "niceness" that will be
observed in the TLS 1.3 protocol as everything will be marked as AEAD,
but this "niceness" has no cryptographic value (the TLS 1.2 construction
with cipher and MAC is authenticated encryption).

Hence, instead of simplifying implementations, the AEAD-only move will
add more code into implementations, duplicate code, increasing the
number of potential bugs, and adding no value.

regards,
Nikos