Re: [TLS] AAED ciphers: AES-GCM vs AES-EAX/AES-CCM: a meta-analysis

[Michael Clark <[e-mail]>]

On 6/1/15 6:24 pm, Peter Gutmann wrote:
> Michael Clark <[e-mail]> writes:
>
>> A TLSv1.3 ClientHello and ServerHello extensions could advertise something
>> like this this:
> Ugh, not, we don't need yet more extensions and complexity, we just need a
> single set of options that everyone uses (see Grigg's Law, "There is only one
> cipher suite and that is #1").

I have some alternative ideas. You probably won't like them ;-)

There are different dimensions of simplicity and complexity relating to
composition and layering.

I think the worst problem with TLS is supporting backwards compatibility.

There is a possibility to add symmetry and reduce complexity. I just
posted about HMAC on handshakes and some other comments, that may
actually mean Encrypt-then-MAC is needed, and you just have hmac_null in
the common case where you are satisfied with the 128-bit tag from the
AEAD cipher.

* handshake
    ETM-AEAD[null,hmac_sha2_256]

* application data
    ETM-AEAD[aead-cipher,hmac_null]

* application data with extended authentication
    ETM-AEAD[aead-cipher,hmac_sha2_256]