Re: [TLS] AES-CCM ECC Cipher Suites for TLS @ IETF 78

["Brian Smith" <[e-mail]>]

David McGrew wrote:
> GCM requires implementation of the AES forward (encrypt) operation and a
> GF(2^128) multiplier.  CCM requires only the AES forward (encrypt)
operation.
> 
> A CCM circuit can be more compact, because it doesn't need a GF(2^128)
> multiplier.  Existing hardware for low-power radio devices typically
> lacks the GF(2^128) multiplier.   GCM would use a bit less power than
> CCM, FWIW.
> 
> Within the low-power radio community, there is probably an expectation
that
> the CCM ciphersuite does not need universal support; it would be adequate
if
> servers for that application environment supported it.

I do not quite understand this last comment. Would a user use a regular web
browser to connect to a 802.15.4-enabled desktop/mobile device to an
administrative interface for an 802.15.4 device over HTTPS?

I agree with Juho's comments regarding the restrictions on ClientHello
extensions and the way support for truncation is supported/requested. I do
not think it makes sense to multiply the number of AEAD cipher suite codes
by 3 just to add truncation support. And, IMO, every implementation should
support the un-truncated form, so it should be impossible for the client to
offer the truncated forms without also offering the un-truncated form.
Specifying the truncation in an extension that the server is free to ignore
would provide for that.

Regards,
Brian