Re: [TLS] Consensus Call on MTI Algorithms

[Brian Smith <[e-mail]>]

Joseph Salowey <[e-mail]> wrote:
> o Symmetric:
>         MUST AES-GCM 128
>         SHOULD ChaCha20-Poly1305

Like others, I think that ChaCha20-Poly1305 should be MUST. It uses
256-bit keys and so it better protects against future quantum and
square-root attacks compared to AES-GCM 128. Also, it is easy to make
a constant-time implementation of ChaCha20-Poly1305 that runs on a
wide variety of hardware, but it is not to easy to do so for AES or
GCM on many times of hardware.

Accordingly, I suggest instead that ChaCha20-Poly1305 MUST be
implemented unless AES-128 GCM *and* AES-256 GCM are implemented in a
constant time manner.

> o Hash:
>         MUST SHA-256

AFAICT, it is not necessary to specify a mandatory-to-implement hash
function separately from the mandatory-to-implement cipher suites and
mandatory-to-implement signature algorithms, because the hash function
to use is always a function of the cipher suite or signature algorithm
in TLS 1.2 and later.

> o Signature:
>         MUST ECDSA P-256
>         MUST RSA

"RSA" is ambiguous. For RSA, please specify which padding scheme(s)
and which parameters must be supported. I would recommend "MUST
implement RSA PKCS#1 using the same digest function used in the PRF of
the selected cipher suite."

Similarly, "MUST ECDSA P-256" should be changed to "MUST ECDSA P-256
using the same digest function used in the PRF of the selected cipher
suite."

If the requirements for mandatory-to-implement signature algorithms
are intended to also apply to certificates and certificate
verification, then ECDSA P-384 and SHA-384 MUST be implemented. The
reason is that CAs often choose algorithms for signing certificates.

Cheers,
Brian