Re: [TLS] (offline note) Re: Confirming Consensus on supporting only AEAD ciphers

[Michael StJohns <[e-mail]>]

On 5/6/2014 1:09 PM, Manuel Pégourié-Gonnard wrote:
> On 06/05/2014 18:24, Michael StJohns wrote:
>> On 5/6/2014 11:11 AM, Joseph Salowey (jsalowey) wrote:
>>> On May 6, 2014, at 5:51 AM, Rene Struik <[e-mail]> wrote:
>>>
>>>> Hi Joe:
>>>>
>>>> In general, an AEAD mode takes as input two strings a and m and a key k, and authenticates a and m, while encrypting m. If m is the empty string, this results in an authentication-only mode.
>>>>
>>>> Thus, AEAD modes can be used to provide suitable combinations of authentication and/or encryption. Examples hereof include the GCM mode and CCM mode.
>>>>
>>> [Joe] Yes, but I don't think any of the defined cipher suites for AES-GCM or AES-CCM support an authentication-only mode.  If authentication-only support is desired then additional cipher suites would have to be defined.
>> If a message consists of 100 bytes of AAD and 0 bytes of plaintext, then the output of an AEAD cipher is the integrity tag over the 100 bytes of AAD and no cipher text.  That's pretty much authentication-only.
>>
> Sure, but as Joe said, within TLS you would need new ciphersuites for that.
> While AES-GCM and AES-CCM in general can do authentication-only, in TLS
> currently they can't because there is no way to include the payload in the AAD
> and to send it in the clear.

Ah.  Sorry - didn't understand that was the point being made.   And an 
absolutely correct one.

So the crypto is the same, but how its used by TLS would change as TLS 
currently defines what part of the message is encrypted and what part is 
AAD.  And to do that you'd have to define a variant of the current 
suites - OR - define some sort of extension to negotiate this.

*bleah*



Mike

>
> Manuel.
>
>