Re: [TLS] Inclusion of OCB mode in TLS 1.3

[Nikos Mavrogiannopoulos <[e-mail]>]

On Wed, 2015-01-14 at 17:11 +0100, Aaron Zauner wrote:

> > This is not the case in the latest draft. Defining only 3 ciphersuites
> > means that PSK will not take advantage of the OCB mode. Is there a
> > reason for that?
> No. If PSK is still going to be supported in TLS 1.3 then I'll have to
> add that as well. This was the newest draft on ChaCha20/Poly1305 I could
> find on the IETF website. Still not that bad in comparison to adding all
> the cipher-suites that conforming with TLS 1.2 would mean.

 Hi,
I don't see why OCB has to be tied to TLS 1.3. The last time such move
was made with having GCM/AEAD restricted to TLS 1.2, it proved quite
wrong (in the sense that not doing it would have avoided the majority of
the problems we saw the last years). TLS 1.3 is a draft document to be
deployed in 2-3 years after published (in the best case scenario). There
is no reason the existing implementations cannot take advantage of OCB,
if ever defined. 

regards,
Nikos