Re: [TLS] Comments on tales from the TLS interim: TLS 1.3 MTI algorithms

[Yoav Nir <[e-mail]>]

> On Mar 23, 2015, at 1:56 PM, Ilari Liusvaara <[e-mail]> wrote:
> 
> On Mon, Mar 23, 2015 at 01:49:16PM -0500, Eric Rescorla wrote:
>> On Mon, Mar 23, 2015 at 1:21 PM, KATO Akihiro <[e-mail]>
>> wrote:
>> 
>>> Hi All．
>>> 
>>> I will comment TLS 1.3 MTI. I'm holding the following points of view.
>>> 
>>> (a) To be avoided Single points of failure,
>>> (b) If possible, back up algorithm suitable for low spec system,
>>> (c) Second point algorithm developed by different concept.
>>> 
>>>> o Symmetric:
>>>>    MUST AES-GCM 128
>>>>    [SHOULD ChaCha20-Poly1305]
>>> 
>>> I have no objection, it is AES-GCM is a MUST. Protocols used DTLS (fg.
>>> CoAP) can not deploy by ChaCha20, which is not second point cipher for
>>> AES. MTI will have second point block cipher using CCM.
>>> 
>> 
>> Why can't DTLS do ChaCha20?
> 
> I presume KATO Akihiro meant that constrained systems can't do Chacha20,
> not that AEAD #29 (Chacha20-Poly1305) has any special problems with
> doing DTLS.

I don’t know why that would be true. The state for ChaCha20 is 64 bytes (16 32-bit integers) with Poly1305 probably rounding it up to a little over 80, and only about 32 of those need to be kept between packets. AES-GCM requires an expanded key and ghash table that total over 800 bytes. The code for both ChaCha and Poly is small enough for even the most constrained systems. Of course if you anyway have the AES-GCM code, the ChaCha code is extra, but I don’t think it’s a big issue for even the 20 KB class of device.

Yoav