Re: [TLS] Comments on various things on agenda (Was: Re: TLS Interim - update and agenda)

[Aaron Zauner <[e-mail]>]

Hi Dave,

Dave Garrett wrote:

> Oh, I'd like to MUST all the things too, but I doubt that'd get consensus. Generally specs get exactly one MTI. One way to do things would be do do the following:
> 

Wouldn't it make sense in the case of TLS to have more than a single MTI
ciphersuite? Given that there are problems with AES-GCM on mobile
devices and ChaCha20 seems to be the contender for multi-plattform
ideally both would be mandatory? AES-GCM has huge performance benefits
on plattforms that do have AESNI instructions so having ChaCha as MTI
will cause implementors to implement both. That's good; but also a bit
confusing instead of having both as MTI. Is there a strong reason why
there _must_ be only one ciphersuite as MTI?

> TLS 1.3 implementations should be required to attempt better security when using old versions, so requiring AES-GCM to do so seems perfectly reasonable.
> 

Exactly.

Aaron