[TLS] draft-mcgrew-aes-ccm

[Eric Rescorla <[e-mail]>]

This document seems to be two proposals in one:

- AES-CCM cipher suites
- A particular set of restrictions on ECC use.

It's not clear to me how those fit together. General TLS practice is, I
think,
to separate Key Exchange and symmetric crypto and to favor RSA for
key exchange. I.e. if we think CCM is interesting, it should probably
not be standardized just for ECC.

IMO it's a bad idea to restrict the use of certs to those signed with
ECDSA *in the cipher suite*. TLS 1.2 provides flexibility for this
algorithm for a reason.

-Ekr