Re: [TLS] Synopsis of CFRG discussions on new stream ciphers and MACs for TLS

["Blumenthal, Uri - 0558 - MITLL" <[e-mail]>]

My order of preference would be:
 - Chacha:   Best.
 - Salsa-20: OK, fine.
 - eSalsa:     If nothing else is available.

From:  <Igoe>, "Kevin M." <[e-mail]>
Date:  Wednesday, October 9, 2013 12:50
To:  "'[e-mail]'" <[e-mail]>
Subject:  [TLS] Synopsis of CFRG discussions on new stream ciphers and MACs
for TLS

> As requested by the TLS WG during IETF-87, the CFRG discussed the
> suitability of the candidate stream ciphers and MACs proposed for
> use in TLS.
>  
> Three stream ciphers have been discussed:
>         € The original SALSA-20
>         € ChaCha, a variant of SALSA-20, modifying the prolog and
>        epilog to increase efficiency.
>         € eStream SALSA-20 (hereafter eSALSA) reduces the number
>         of rounds from 20 rounds in SALSA-20 down to 12 rounds in
>         eSalsa.
>  
> The discussion of these stream ciphers boiled down to the
> following points:
>         € There seems to be substantial controversy over the
>       efficiency of the various stream cipher candidates,
>       especially when compared to AES counter modes. This
>        needs to be straightened out before aninformed decision
>       can be made.
> On the maturity of the cryptanalysis of the three stream ciphers:
>         € The analysis of SALSA-20 has been very thorough and the
>         degree of confidence in SALSA-20 is very high.
>         € Though ChaCha has received slightly less analysis, the
>         CFRG is confident that the analysis was sufficiently
>         thorough that ChaCha is an acceptable alternative to
>         SALSA-20.
>         € The RG was less comfortable with the maturity of the
>         analysis of eSALSA, but no substantive objections were
>         raised.
> Cryptanalytically all three are almost certainly sufficient for
> use in TLS.  The RG expressed a preference for ChaCha.
>  
> We were also asked our opinion on the MACs being considered, UMAC
> and POLY1305. No cryptanalytic issues were raised, though VMAC was
> suggested as a more efficient alternative to UMAC. The
> suitability of these MACs for efficient hardware implementation
> was questioned.
>  
>  
> ----------------+--------------------------------------------------
> Kevin M. Igoe   | "We can't solve problems by using the same kind
> [e-mail]  | of thinking we used when we created them."
>                 |              - Albert Einstein -
> ----------------+--------------------------------------------------
>  
>  
>