[TLS] ECDH_anon I-D (was: A la carte handshake negotiation)

[Dave Garrett <[e-mail]>]

On Friday, June 12, 2015 12:55:59 pm Viktor Dukhovni wrote:
> On Fri, Jun 12, 2015 at 12:36:17PM -0400, Dave Garrett wrote:
> > AES CBC already cannot be used with TLS 1.3+, as it now requires AEAD ciphers only.
[...]
> The DH AEAD ciphersuite set includes two DH_anon members.  For ECDH
> AEAD there are none.
> 
> > TLS_ECDH_anon_WITH_AES_256_GCM_SHA384 is in this expired draft:
> > https://tools.ietf.org/html/draft-williams-tls-anon-ecdh-modern-cipher-01
> 
> Yes, I asked Nico to help fill the gap.  I guess this did not go
> very far.
[...]
> > Just properly publishing a "ECDH_anon" RFC would be preferable,
> > however.

Resurrecting this draft seems like a good idea, regardless of TLS 1.3.

https://tools.ietf.org/id/draft-williams-tls-anon-ecdh-modern-cipher-01.html

It defines:
==============================
TLS_ECDH_anon_WITH_AES_128_GCM_SHA256
    This is anonymous key agreement with ephemeral ECDH keys, with AES-128 in GCM mode, and SHA256 as the hash function for the TLS PRF.
TLS_ECDH_anon_WITH_AES_128_CCM_SHA256
    This is anonymous key agreement with ephemeral ECDH keys, with AES-128 in CCM mode, and SHA256 as the hash function for the TLS PRF.
TLS_ECDH_anon_WITH_AES_256_GCM_SHA384
    This is anonymous key agreement with ephemeral ECDH keys, with AES-256 in GCM mode, and SHA384 as the hash function for the TLS PRF.
TLS_ECDH_anon_WITH_AES_256_CCM_SHA384
    This is anonymous key agreement with ephemeral ECDH keys, with AES-256 in CCM mode, and SHA384 as the hash function for the TLS PRF.
==============================

If we're to update this draft, I think we should really change the "ECDH" to "ECDHE" here. It would make specifying which suite prefixes are permitted a lot simpler and less prone to confusion, as the current naming is inconsistent. All ephemeral should have the 'E' on the end, regardless of how it's provided.

Also, adding new ECC anon versions for other ciphers in the same document, like ARIA-GCM [RFC6209] and CAMELLIA-GCM [RFC6367], might be warranted.


Dave