Re: [TLS] WG adoption + early code point assignment: draft-mavrogiannopoulos-chacha-tls

[Eric Rescorla <[e-mail]>]

On Tue, May 19, 2015 at 11:43 PM, Nikos Mavrogiannopoulos <[e-mail]>
wrote:

> ----- Original Message -----
> > I am in favor of this draft.
> >
> > Prior to doing the code point assignment, however, we should resolve
> > the question of the per-record nonce algorithm. The current draft uses
> > an algorithm that is not consistent either with the algorithm we use for
> > GCM or TLS 1.3.
> >
> > - TLS 1.2 GCM: 32-bit fixed salt || 64-bit explicit per-record IV
> > - TLS 1.3: fixed mask XORed with the record sequence number
> > - ChaCha: 32-bit fixed salt || record sequence number
>
> I think the chacha draft is consistent with the TLS 1.2 GCM draft. The TLS
> 1.2 GCM draft allows as an option (MAY) to have "32-bit fixed salt ||
> record sequence number",
> and in fact all implementations do that. So this draft simply ratifies that
> approach and changes that requirement to MUST.


Not just that. It also doesn't carry the RSN on the wire, which the GCM one
does.

-Ekr

The approach in TLS 1.3 is a novel
> one and I don't think it suits this draft.
>
> regards,
> Nikos
>