Re: [TLS] AAED ciphers: AES-GCM vs AES-EAX/AES-CCM: a meta-analysis

[Michael Clark <[e-mail]>]

The other point being to remove MAC-then-encrypt from TLSv1.3, not
necessarily AES-CBC (as its non parallelism is a good property in
certain situations).

The principle is considering TLSv1.3 from a 'profile' perspective and
that the 'known problematic' MAC-then-encrypt could be supported by
implementations that choose to offer TLSv1.2 (and older) profiles and
drop encrypt-then-MAC and make MAC-then-encrypt mandatory in the TLSv1.3
profile. i.e. a clean up, and improvement to auth integrity.

The principle being we shouldn't preserve back compatibility by
incorporating old baggage into to the new spec, rather have a design
that allows implementations to support older profiles.

This would make the spec simpler. TLsv1.3 would be completely
encrypt-then-MAC including the ability to augment AEAD ciphers with more
authentication bits. i.e. symmetrical (except for a special case of
hmac_null where the auth bits equals the tag bits of the AEAD cipher and
how the AD is handled for encrypt-then-MAC with an AEAD cipher).

my 2 cents.

On 25/12/14 9:01 am, Michael Clark wrote:
> Hi Peter,
> 
> Someone pointed out RFC 7366 to me off list. I will read. I like the
> idea of encrypt-then-MAC being a core requirement for TLSv1.3.
> 
> Before I've read through can we do this with it?
> 
> AES-256-GCM + hmac_null   = 128 bits authentication
> AES-256-CBC + hmac_sha128 = 128 bits authentication
> 
> AES-256-GCM + hmac_sha128 = 256 bits authentication
> AES-256-CBC + hmac_sha256 = 256 bits authentication
> 
> AES-256-GCM + hmac_sha256 = 384 bits authentication
> AES-256-CBC + hmac_sha384 = 384 bits authentication
> 
> I like the idea of >= 256 bits authentication, and the idea of the
> combination of a cipher based MAC and PRF based MAC for AES-GCM, given
> the properties of the AES-GCM CTR mode 'variant' and GHASH GF(2^128).
> 
> Michael.
> 
> 
> On 24/12/14 2:15 pm, Peter Gutmann wrote:
>> Michael Clark <[e-mail]> writes:
>>
>>> I have been doing some independent research on TLS AEAD ciphers and decided
>>> to share a meta-analysis on AES-GCM versus AES-EAX/AES-CCM
>>
>> If you're going to look at these, what about also looking at encrypt-then-MAC,
>> which is another AEAD mechanism?
>>
>> Peter.
>>
>> _______________________________________________
>> TLS mailing list
>> [e-mail]
>> https://www.ietf.org/mailman/listinfo/tls
>>
> 
> _______________________________________________
> TLS mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/tls
>