Re: [TLS] AAED ciphers: AES-GCM vs AES-EAX/AES-CCM: a meta-analysis

[Nikos Mavrogiannopoulos <[e-mail]>]

On Mon, 2015-01-26 at 13:08 -0600, Tom Ritter wrote:

> Length Hiding in TLS gets you good protection against passive captures
> and lets you deploy the mechanism independent of building in the
> feature at Layer 7 or above in multiple applications, application
> protocols, web frameworks, etc.  (Some of which may be old and
> unmaintained, but still running lots of services on the Internet.)
> 
> >From my recollection at Denver:
>  - Consensus was we didn't want to pay a 2-byte penalty to put padding
> in everywhere by default
> - Rough Consensus was padding without paying a penalty was something
> reasonable to pursue
 
If that refers to draft-pironti-tls-length-hiding-02, I believe these
comments are mislead. There is no penalty "everywhere" as you pose it.
Peers who need no padding don't use the additional length bytes. Only
peers who need to hide length use these two bytes. This is not a
penalty, as it can simply be considered part of the pad (min size of pad
= 2).

regards,
Nikos