Re: [TLS] Inclusion of OCB mode in TLS 1.3

[Nico Williams <[e-mail]>]

On Wed, Jan 21, 2015 at 04:21:38PM +0000, Salz, Rich wrote:
> What does OCB bring to the table that justifies such a huge increase
> (10%) in the number of ciphers.

Cartesian explosion of unrelated things is a problem TLS has that it
doesn't need to have in 1.3.

Key exchange, server authentication, PRF, hash functions, and
cipher+mode, should all be negotiated separately (but cipher and mode
must be negotiated together).  Yes, in some cases key exchange and
server authentication can be very closely tied, e.g., RSA key transport.
SSHv2 gets all of this right; why can't TLS 1.3?

> We need a cipher cage match.  They call go in, and only a couple come
> out.

That seems unrealistic :(

Nico
--