Re: [TLS] Inclusion of OCB mode in TLS 1.3

[Aaron Zauner <[e-mail]>]

Nico Williams wrote:
> Sure, but why not just deprecate/remove non-ECDH ciphersuites and be done?

That'd be the best option, I agree. But Nikos pointed out that people
might still want PSK without diffie-hellman at all for confined
environments/embedded. Otherwise I wouldn't have put it in there in the
first place. I'm happy to remove these ciphersuites if there's consensus.


> Negotiate key exchange, server authentication, PRF, hash, and
> cipher+mode separately.  (Cipher and mode go together, as not every mode
> makes sense for every cipher, but key exchange should have no relation
> to the choice of cipher+mode.)  Key exchange and server authentication
> are closely tied in some cases (e.g., RSA key transport), but that's not
> a problem (SSHv2 managed).

Sounds like a plan. But more like something for the TLS spec than this
ID, right?

RSA as key transport doesn't concern this ID anyway. And AFAIK it's
going deprecated with TLS 1.3 because of security concerns. I've even
explicitly stated it in the security considerations section of my ID.

Aaron