Re: [TLS] Consensus Call on MTI Algorithms

[Dave Garrett <[e-mail]>]

On Friday, April 03, 2015 09:55:32 am Watson Ladd wrote:
> On Apr 2, 2015 11:49 AM, "Nico Williams" <[e-mail]> wrote:
> > On Wed, Apr 01, 2015 at 11:12:19AM -0700, Joseph Salowey wrote:
> > > o Symmetric:
> > >         MUST AES-GCM 128
> > >         SHOULD ChaCha20-Poly1305
> >
> > I would like at least two modes for AES to be required: one AEAD
> > (probably GCM) and one AEAD-by-generic-construction (e.g., using HMAC).
> 
> OCB is a better fit constrained devices. CCM requires two passes.

So, at this point in the discussion, this is sounding like what might get closer to agreement:

o Symmetric:
        MUST AES-OCB 128 (or 256?)
        MUST ChaCha20-Poly1305
        OPTIONAL AES-GCM 128, but MUST if supporting TLS 1.2

This is essentially 2 MTI for TLS 1.3, with a required amendment to the TLS 1.2 spec to add an AEAD MTI. Without this, when falling back a version there'd be a higher likelihood of having to downgrade to CBC. (current draft has a SHOULD for using AEAD with TLS 1.2, if available)

The question is, however: is the WG willing to specify two new MTI? Not having one that's currently in widespread use might slow adoption. Then again, ChaChaPoly is getting out there from Google's pushing of it. Or, all 3 could just be MUSTs.


Dave