Re: [TLS] I-D Action: draft-ietf-tls-chacha20-poly1305-00.txt

[Viktor Dukhovni <[e-mail]>]

On Sun, Jun 14, 2015 at 02:17:29PM +0200, Simon Josefsson wrote:

> > After discussion earlier involving ECDHE_anon cipher suites, it
> > occurred to me that it could be useful to define one for ChaChaPoly in
> > this draft.
> >
> > Is it viable to add a cipher suite name and codepoint for this?
> 
> What is the use-case?

0.   Authentication other than via certificate-based PKI.  Establish
     anon TLS, and channel-bind the TLS-unique via GSSAPI or some
     other authentication method.

1.  Unauthenticated opportunistic TLS.

    * Server performs no unnecessary signature operations,
      since the client can't verify the signature anyway.
      (More precisely the client can't verify the authenticity
      of the server keys, so it can only determine that somebody
      signed the handshake, but no idea whether it is the intended
      server).

    * Servers can tell which clients are not verifying their
      identity, (definitely the ones the offer or negotiate "anon"
      ciphersuites).  This is useful information.

-- 
	Viktor.