Re: [TLS] Inclusion of OCB mode in TLS 1.3

[Martin Thomson <[e-mail]>]

On 13 January 2015 at 09:04, Aaron Zauner <[e-mail]> wrote:
> Now I'm a bit clueless as to how new AEAD modes are supposed to be
> added to TLS 1.3.


In this case, I would suggest writing an Internet Draft describing how
the cipher suite is identified and how it operates.  That would be a
relatively short document.

Unless there are specific reasons not to, a new AEAD cipher should be
defined for TLS 1.2 as well.  One reason (that doesn't apply to OCB)
is that it might require non-deterministic padding, for which there is
a bug in the TLS 1.2 AEAD construction (see
https://github.com/tlswg/tls13-spec/issues/47).

There are, of course, reasons why people would not want to accept a
proposal like that.  More cipher suites isn't strictly a good thing.
Of course, if OCB is demonstrably better in some fashion (speed,
security, whatever it happens to be), then that makes the case easier.