Re: [TLS] AES-OCB in TLS [New Version Notification for draft-zauner-tls-aes-ocb-03.txt]

[Aaron Zauner <[e-mail]>]

Peter Bowen wrote:
> On Mon, Jun 1, 2015 at 9:06 AM, Aaron Zauner <[e-mail]> wrote:
>> I agree, but am unsure to what extent they are used in real life. I'm
>> trying to reduce the number of cipher-suites that would have to be added
>> to the IANA TLS parameter list; since PSK is unsupported with GCM
>> cipher-suites it seems only logical to exclude them here as well.
> 
> Some TLS implementations (notably BoringSSL) have ended up assigning
> non-standard ciphersuites ECDHE+PSK+AES-GCM for this very reason.  I
> think the lack of this combination is more of an oversight than
> anything.
> 

Unsure if RFC5478 got introduced after the fact, but this document seems
to be the one defining those cipher-suites. In addition it defines PSK
cipher-suites in CBC-mode using SHA256+.

https://tools.ietf.org/html/rfc5487

This is all quite confusing and spread over a lot of different
documents. PSK in CBC-mode (with < SHA256) for example is a different
document (RFC4279).

I'll leave it up to long-time TLS-WG members to decide where these PSK
cipher-suites /would/ fit best. I'm not sure that this document is the
right place -- but that's only because, in the past, PSK cipher-suite
were dealt with exclusively in separate documents as it seems.

Aaron