Re: [TLS] Consensus Call on MTI Algorithms

[Nico Williams <[e-mail]>]

On Wed, Apr 01, 2015 at 05:35:30PM -0400, Sean Turner wrote:
> On Apr 01, 2015, at 14:12, Joseph Salowey <[e-mail]> wrote:
> 
> > o Symmetric:
> >         MUST AES-GCM 128
> >         SHOULD ChaCha20-Poly1305
> 
> Nobody 2119-me-to-death, but I paraphrase SHOULD as: this is a MUST
> unless you have a really, really, really, really good reason to not do
> it.

The same is really true of the MUST, because if AES-128-GCM dies on the
cryptanalysis table, well, we'll all want to turn it off and start
ripping it out of the implementations as soon as possible.

We really need *two* mandatory-to-implement algorithms for each class at
the 128-bit security level.

Your interpretation of SHOULD is a bit stronger than what RFC2119 says.
We shouldn't play RFC2119 interpretation games.  We should say what we
want.  We *should* want what I said above (already repeating myself).

Nico
--