Re: [TLS] Spec tls13 comments, handshake tampering, mitigation, counter/seq_no predictability: WAS: Do we need DH?

[Nikos Mavrogiannopoulos <[e-mail]>]

On Wed, 2015-01-07 at 08:29 +0800, Michael Clark wrote:
> These ciphers are essentially the four AEAD ciphers that have existing
> IETF RFCs or drafts. CCM is a valid AEAD cipher choice and fits within
> the draft framework.
> However my earlier comment was that EAX (a NIST candidate) has
> complementary properties and a security proof. EAX2, the foundation for
> AES_EAX provides a generalized framework for Encypt-then-MAC i.e.
> EAX2[AES,OMAC2[AES]]
> I'm not attached to any of the ciphers and don't have an interest in
> CCM, other than having a choice of 3 AEAD ciphers, and one of them from
> NTT would be good. My conclusion on reading the literature was that EAX
> has better properties than CCM, despite its slightly longer key setup
> time (less then GCM) and equivalent performance to CCM. CCM is more like
> CBC mode with MAC whereas EAX is more like CTR mode (GCM) with IV
> increased entropy in the counter and the use of an alternative cipher
> based MAC, making it complementary to the current suite.

I also prefer EAX to CCM. CCM is a very special and limited AEAD mode
(e.g., it needs to know the size of the encrypted data in advance), and
I'd avoid using it when possible.

regards,
Nikos