Re: [TLS] Inclusion of OCB mode in TLS 1.3

[Nikos Mavrogiannopoulos <[e-mail]>]

On Wed, 2015-01-21 at 17:58 +0100, Aaron Zauner wrote:

> > If DHE_PSK is relevant to an embedded device then all cipher+mode
> > combinations might be as well.  Obviously OCB wouldn't be required to
> > implement, but that's no reason to exclude any one subset of ciphersuits
> > using OCB.
> Well. No. Not really. Why would an embedded device prefer to do DHE over
> ECDHE? ECC operations are sure to be more efficient on embedded
> devices/IoT. That's was my reason to ask for removal.

It will not. However, there will be no PFS fallback if for some reason
there is some attack on ECDHE that is not applicable on DHE. In any case
I don't find the issue critical. Even if removed it's only 2
ciphersuites saved, and we are nowhere close to believing that the
ciphersuite space is close to an end.

regards,
Nikos