Re: [TLS] Suite B compliance of TLS 1.2

Eric Rescorla wrote:
>
> I'm not that familiar with Suite B, but if it, as you
> say, it doesn't include a MAC algorithm, I'm not sure
> what you're suggesting for message integrity.

I'm not a cryptographer, so I am struggling with these
questions.

Option 1: investigate whether HMAC-SHA-1 is still secure
and consider HMAC-SHA-256 and HMAC-SHA-384.

In NIST Special Publication (SP) 800-57 Part 1
(http://csrc.nist.gov/publications/nistpubs/800-57/SP800-57-Part1.pdf),
Table 3 (in Section 5.6.1 on page 64) lists the security
strengths of HMAC with various hash functions.  It shows
that HMAC-SHA-1 may only be used for <= 128 bits of security,
and HMAC-SHA-256 may be used for <= 256 bits of security.
This would imply that the AES_128 TLS cipher suites may
continue to use HMAC-SHA-1 but the AES_256 TLS cipher
suites should use HMAC-SHA-256.

In his talk "NIST Cryptographic Standards Status Report"
at this year's PKI R&D Workshop, Bill Burr of NIST provided
some information that helps interpret Table 3 in SP 800-57 Part 1.
(http://middleware.internet2.edu/pki06/proceedings/burr-nist_crypto_standards.ppt)

Slide 20 says:
   Federal users [...] may continue to use SHA-1 after 2010 for:
   - HMAC
   - Key derivation
   - Random number generation
Slide 30 explains why Suite B uses AES 256 (rather than AES 192)
for applications that require 192 bits of security.  So in Table
3 we only need to look at the rows for 128 and 192 bits of security
for Suite B compliance.

Option 2: consider Galois/Counter Mode (GCM) of AES.
(http://csrc.nist.gov/publications/drafts.html#sp800-38D)

This mode of operation provides message integrity and doesn't
use any (general purpose) cryptographic hash function.  So
GCM seems to avoid the hash function issue altogether,
although GCM still uses a keyed hash function called GHASH.
TLS could use GCM for both encryption and message integrity
(note: the ordering of encryption and MAC'ing is different
between GCM and current versions of TLS) or just for message
integrity (called GMAC).

The TLS working group's web page says:

   The TLS WG will also work on new authenticated
   encryption modes for TLS, including modes based on counter mode
   encryption (CTR) and combined encryption/authentication modes,
   and may define major new cipher suites for TLS for this purpose.

Is GCM the new authenticated encryption mode?

Wan-Teh

_______________________________________________
TLS mailing list
TLS@lists.ietf.org
https://www1.ietf.org/mailman/listinfo/tls