Re: [TLS] (offline note) Re: Confirming Consensus on supporting only AEAD ciphers

[Michael StJohns <[e-mail]>]

On 5/6/2014 12:20 PM, Martin Rex wrote:
> I can not correlate your most recent response to the prior question:
>
>> Michael StJohns wrote:
>>> Sorry - I'm coming late here.  Does this also imply the complete
>>> elimination of the integrity only cipher suites?
> I understand this to refer to these cipher suites:
>      CipherSuite TLS_RSA_WITH_NULL_MD5                  = { 0x00,0x01 };
>      CipherSuite TLS_RSA_WITH_NULL_SHA                  = { 0x00,0x02 };
>
> which provide authentication PLUS integrity, but no confidentiality.

That and about 2 dozen others that are WITH_NULL.


>
> Rene Struik wrote:
>> In general, an AEAD mode takes as input two strings a and m and a key k,
>> and authenticates a and m, while encrypting m. If m is the empty string,
>> this results in an authentication-only mode.
>>
>> Thus, AEAD modes can be used to provide suitable combinations of
>> authentication and/or encryption. Examples hereof include the GCM mode
>> and CCM mode.
> Now this seems to refer to an idea to provide only (initial) authentication,
> but no integrity protection of the actual application data (m).

Nope.  AEAD ciphers provide integrity protection across the entire 
message, plaintext and associated data.  So if the message consists only 
of associated data, that associated data data is still protected.

(m) and (a) together are the application data, not solely (m).  (m) is 
just the data to be encrypted.

Mike

>
> -Martin
>
>