Re: [TLS] WG adoption + early code point assignment: draft-mavrogiannopoulos-chacha-tls

> On 20 May 2015, at 00:14, Martin Thomson <martin.thomson@gmail.com> wrote:
> 
> On 19 May 2015 at 14:51, Yoav Nir <ynir.ietf@gmail.com> wrote:
>> 2) I question the need for TLS_DHE_ ciphersuites, and I seriously doubt anybody’s going to use those with ChaCha20 “in the wild”. Other than that, I’m all for early assignment as it would allow us to get the algorithms into code-bases and test interoperability quicker.
> 
> I tend to agree.  Can someone reply with a brief explanation of why
> each of the following is needed?  Hopefully better than what I was
> able to devise:
> 
> TLS_RSA_WITH_CHACHA20_POLY1305
> Because we’re scared of ephemeral key exchange for some reason ?

I am not, so you shouldn’t =P

> TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305
> Because ECDHE is good, and RSA is widespread.

Yes

> TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305
> Because this is what we actually want.

Yes

> TLS_DHE_RSA_WITH_CHACHA20_POLY1305
> Because we need a backup for EC.

Better safe than sorry.

> TLS_DHE_PSK_WITH_CHACHA20_POLY1305
> Because ECDHE is nice, but we need a backup, even for little things ?

Is this sentence hiding something ? ;)
I am really not sure about this one, why since there is EC…

> TLS_PSK_WITH_CHACHA20_POLY1305
> Because little things don’t like paying for asymmetric crypto.

Fair enough

> TLS_ECDHE_PSK_WITH_CHACHA20_POLY1305
> Because little things need nice things too.

Yes

> TLS_RSA_PSK_WITH_CHACHA20_POLY1305
> Because little things like doing bignum exponentiation without any PFS
> payoff, but RSA alone isn’t "secure enough" ?

Arf ! chop off it’s RSA ! 

> The thing that concerns me most is that we aren't saying that PFS is
> required outside of PSK.  I understand the carve-out we've made for
> the little things, but I don't understand why we are defining
> RSA-based suites without PFS.
> 
> Of comparable concern is the RSA_PSK stuff.  I wasn't around for the
> definition of these originally, but they make basically no sense to
> me.

Agreed

> I get the DHE_PSK thing if you justify it using the same basis as
> DHE_RSA, but it might be that the little things can just take a pass
> on PFS without ECDHE.
> 
> Would it be unreasonable to cut the list to ... ?
> TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305
> TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305
> TLS_DHE_RSA_WITH_CHACHA20_POLY1305
> TLS_PSK_WITH_CHACHA20_POLY1305
> TLS_ECDHE_PSK_WITH_CHACHA20_POLY1305

I completely agree with Martin on this list, we probably do not need more ciphersuites than those.

> Also, I'm not against DHE in general, and I think that it's worth
> keeping around for a little longer. However.  If we consider DHE_RSA
> worth doing, then the only logic I can concoct would provide almost
> equal justification for DHE_ECDSA.

I really don’t think DHE_ECDSA will ever by massively used …
It would be like having RSA_ECDSA =s..

Cheers,
B.

> _______________________________________________
> TLS mailing list
> TLS@ietf.org
> https://www.ietf.org/mailman/listinfo/tls