Re: [TLS] Synopsis of CFRG discussions on new stream ciphers and MACs for TLS

"Blumenthal, Uri - 0558 - MITLL" <uri@ll.mit.edu> Wed, 09 October 2013 17:12 UTC

Return-Path: <prvs=3994e4542f=uri@ll.mit.edu>
X-Original-To: tls@ietfa.amsl.com
Delivered-To: tls@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2E8F021E811C for <tls@ietfa.amsl.com>; Wed, 9 Oct 2013 10:12:31 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -5.201
X-Spam-Level:
X-Spam-Status: No, score=-5.201 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, HTML_MESSAGE=0.001, MIME_QP_LONG_LINE=1.396, RCVD_IN_DNSWL_MED=-4, UNPARSEABLE_RELAY=0.001]
Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id f9oulQRkDIJ7 for <tls@ietfa.amsl.com>; Wed, 9 Oct 2013 10:12:26 -0700 (PDT)
Received: from mx2.ll.mit.edu (MX2.LL.MIT.EDU [129.55.12.46]) by ietfa.amsl.com (Postfix) with ESMTP id 9ECA121E808F for <tls@ietf.org>; Wed, 9 Oct 2013 10:12:25 -0700 (PDT)
Received: from LLE2K7-HUB01.mitll.ad.local (LLE2K7-HUB01.mitll.ad.local) by mx2.ll.mit.edu (unknown) with ESMTP id r99HCM5J015362; Wed, 9 Oct 2013 13:12:22 -0400
From: "Blumenthal, Uri - 0558 - MITLL" <uri@ll.mit.edu>
To: "Igoe, Kevin M." <kmigoe@nsa.gov>, "'tls@ietf.org'" <tls@ietf.org>
Date: Wed, 9 Oct 2013 13:12:17 -0400
Thread-Topic: [TLS] Synopsis of CFRG discussions on new stream ciphers and MACs for TLS
Thread-Index: Ac7FErd22MJxngiOQxat1EJ+pkWVtw==
Message-ID: <CE7B065E.12302%uri@ll.mit.edu>
In-Reply-To: <3C4AAD4B5304AB44A6BA85173B4675CAB24E246F@MSMR-GH1-UEA03.corp.nsa.gov>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach: yes
X-MS-TNEF-Correlator:
user-agent: Microsoft-MacOutlook/14.3.8.130913
acceptlanguage: en-US
Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha256; boundary="B_3464169137_10415650"
MIME-Version: 1.0
X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:5.10.8794, 1.0.431, 0.0.0000 definitions=2013-10-09_05:2013-10-09, 2013-10-09, 1970-01-01 signatures=0
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 spamscore=0 suspectscore=0 phishscore=0 adultscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=7.0.1-1305240000 definitions=main-1310090063
Subject: Re: [TLS] Synopsis of CFRG discussions on new stream ciphers and MACs for TLS
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/tls>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 09 Oct 2013 17:12:31 -0000

My order of preference would be:
 - Chacha:   Best.
 - Salsa-20: OK, fine.
 - eSalsa:     If nothing else is available.

From:  <Igoe>, "Kevin M." <kmigoe@nsa.gov>
Date:  Wednesday, October 9, 2013 12:50
To:  "'tls@ietf.org'" <tls@ietf.org>
Subject:  [TLS] Synopsis of CFRG discussions on new stream ciphers and MACs
for TLS

> As requested by the TLS WG during IETF-87, the CFRG discussed the
> suitability of the candidate stream ciphers and MACs proposed for
> use in TLS.
>  
> Three stream ciphers have been discussed:
>         € The original SALSA-20
>         € ChaCha, a variant of SALSA-20, modifying the prolog and
>        epilog to increase efficiency.
>         € eStream SALSA-20 (hereafter eSALSA) reduces the number
>         of rounds from 20 rounds in SALSA-20 down to 12 rounds in
>         eSalsa.
>  
> The discussion of these stream ciphers boiled down to the
> following points:
>         € There seems to be substantial controversy over the
>       efficiency of the various stream cipher candidates,
>       especially when compared to AES counter modes. This
>        needs to be straightened out before aninformed decision
>       can be made.
> On the maturity of the cryptanalysis of the three stream ciphers:
>         € The analysis of SALSA-20 has been very thorough and the
>         degree of confidence in SALSA-20 is very high.
>         € Though ChaCha has received slightly less analysis, the
>         CFRG is confident that the analysis was sufficiently
>         thorough that ChaCha is an acceptable alternative to
>         SALSA-20.
>         € The RG was less comfortable with the maturity of the
>         analysis of eSALSA, but no substantive objections were
>         raised.
> Cryptanalytically all three are almost certainly sufficient for
> use in TLS.  The RG expressed a preference for ChaCha.
>  
> We were also asked our opinion on the MACs being considered, UMAC
> and POLY1305. No cryptanalytic issues were raised, though VMAC was
> suggested as a more efficient alternative to UMAC. The
> suitability of these MACs for efficient hardware implementation
> was questioned.
>  
>  
> ----------------+--------------------------------------------------
> Kevin M. Igoe   | "We can't solve problems by using the same kind
> kmigoe@nsa.gov  | of thinking we used when we created them."
>                 |              - Albert Einstein -
> ----------------+--------------------------------------------------
>  
>  
>