Re: [TLS] Comments on various things on agenda (Was: Re: TLS Interim - update and agenda)

[Dave Garrett <[e-mail]>]

On Sunday, March 08, 2015 02:36:15 pm Eric Rescorla wrote:
> On Sun, Mar 8, 2015 at 11:24 AM, Dave Garrett <[e-mail]> > wrote:
> > On Sunday, March 08, 2015 02:03:10 pm Ilari Liusvaara wrote:
> > > MTI cipher suites:
> > > ------------------
> > > I see there being only two realistic AEAD ciphers:
> > >
> > > - AES-GCM (if you have hardware support)
> > > - Chacha20-Poly1305-AEAD (no need for hardware support)
> >
> > On this topic, a thought to consider:
> > If Chacha20-Poly1305-AEAD were made MTI for TLS 1.3, that would greatly
> > increase roll-out of the new cipher. AES-GCM could be listed as SHOULD
> > support. Existing TLS 1.2 implementations generally support it already, so
> > this would most likely provide two cipher suites that most can be expected
> > to have available. On the other hand, if AES-GCM were chosen as MTI, then
> > we would have to rely on merely encouraging implementations to consider
> > alternatives.
> 
> I tend to take the opposite attitude. The purpose of MTI is to provide a guaranteed
> minimum for interoperabilty, and given that GCM is generally supported, that
> seems like the natural choice.

It is of course the obvious choice, which is why I'm speaking up to encourage an alternative. TLS 1.3 is on track to have a one-true-cipher of AES-GCM, with alternatives slowly coming into play. This is something many would like to avoid, so a different decision here could affect that. ChachaPoly also has the benefit of playing nice with hardware, making MTI potentially easier on some. It's not a bad decision if AES-GCM is picked as MTI, but I do think it is very much worth considering the total end result and not just the minimum interop.


Dave