Re: [TLS] EXTERNAL: Re: integrity only ciphersuites

On Mon, Aug 20, 2018 at 2:36 PM, Jack Visoky <jmvisoky@ra.rockwell.com>
wrote:

> Hi Eric,
>
> Thanks for your feedback.  Just a few points to add:
>
> 1. There really are some applications where confidentiality isn’t
> important, for example some motion control that might involve very simple
> move instructions (e.g. go to X, go to Y, go to Z, repeat).  Certainly
> there are also applications that would benefit from confidentiality, but
> there’s a non-trivial amount that really gain little to nothing.
>

Why do you think this isn't sensitive information? I can imagine scenarios
where it's not, but it also might be, as, for instance, it leaks the level
of activity of the device.

2. In some cases the code size is quite important.  It’s not uncommon for
> hardware to be in the field in Industrial Automation for 15 or more years,
> so in some cases the hardware is already stretched pretty thin and might
> not be able to handle the demands of encryption.  At the same time it is
> hugely beneficial to take advantage of the security of TLS for many of
> these installations.
>

This seems not very specific. Can you provide some actual numbers for the
difference in code size to have encryption as a fraction of the total code
size?

> 3. Another use case for these NULL encryption suites is around inspection
> of data.  I think this has been discussed in this forum already, but these
> cipher suites could support that as well.
>

Supporting this use case is not really a priority for this WG. In fact,
it's part of why we removed these ciphers in TLS 1.3.

-Ekr

> Thanks and Best Regards,
>
> Jack Visoky
> Security Architect and Sr. Project Engineer
> Common Architecture and Technology Group
> Rockwell Automation | 1 Allen-Bradley Drive | Mayfield Heights, OH 44124
>
>
>
> From: TLS [mailto:tls-bounces@ietf.org] On Behalf Of Eric Rescorla
> Sent: Monday, August 20, 2018 4:58 PM
> To: Nancy Cam-Winget (ncamwing) <ncamwing=40cisco.com@dmarc.ietf.org>
> Cc: tls@ietf.org
> Subject: EXTERNAL: Re: [TLS] integrity only ciphersuites
>
> [Use caution with links & attachments]
>
>
>
> On Mon, Aug 20, 2018 at 1:48 PM, Nancy Cam-Winget (ncamwing) <ncamwing=
> 40cisco.com@dmarc.ietf.org> wrote:
> All,
> A couple IoT consortiums are trying to embrace the improvements made to
> TLS 1.3 and as they define their new security constructs would like to
> adopt the latest protocols, in this case TLS 1.3.   To that extent, they
> have a strong need for mutual authentication, but integrity only (no
> confidentiality) requirements.
>
>
> In following the new IANA rules, we have posted the draft
> https://tools.ietf.org/html/draft-camwinget-tls-ts13-macciphersuites-00
> to document request for registrations of HMAC based cipher selections with
> TLS 1.3…..and are soliciting feedback from the WG on the draft and its path
> forward.
>
> Nancy,
>
> As you say, you don't need WG approval for code point registration as long
> as you don't want Recommended status.
>
> With that said, I don't think this document makes a very strong case for
> these cipher suites. Essentially you say:
>
> 1. We don't need confidentiality
> 2. Code footprint is important
>
> Generally, I'm not very enthusiastic about argument (1). It's often the
> case that applications superficially need integrity but actually rely on
> confidentiality in some way (the obvious case is that HTTP Cookies are an
> authentication mechanism, but because they are a bearer token, you actually
> need confidentiatilty). It's much easier to just always supply
> confidentiality than to try to reason about when it is or is not needed.
>
> The second argument is that you are trying to keep code size down. It's
> true that not having AES is cheaper than having AES, but it's possible to
> have very lightweight AES stacks (see for instance:
> https://github.com/01org/tinycrypt).
>
> So, overall, this doesn't seem very compelling..
>
> -Ekr
>
>
>
>
> Warm regards, Nancy (and Jack)
>
> _______________________________________________
> TLS mailing list
> TLS@ietf.org
> https://www.ietf.org/mailman/listinfo/tls
>
>