Re: [TLS] Comments on various things on agenda (Was: Re: TLS Interim - update and agenda)

[Eric Rescorla <[e-mail]>]

On Sun, Mar 8, 2015 at 11:24 AM, Dave Garrett <[e-mail]>
wrote:

> On Sunday, March 08, 2015 02:03:10 pm Ilari Liusvaara wrote:
> > MTI cipher suites:
> > ------------------
> > I see there being only two realistic AEAD ciphers:
> >
> > - AES-GCM (if you have hardware support)
> > - Chacha20-Poly1305-AEAD (no need for hardware support)
>
> On this topic, a thought to consider:
> If Chacha20-Poly1305-AEAD were made MTI for TLS 1.3, that would greatly
> increase roll-out of the new cipher. AES-GCM could be listed as SHOULD
> support. Existing TLS 1.2 implementations generally support it already, so
> this would most likely provide two cipher suites that most can be expected
> to have available. On the other hand, if AES-GCM were chosen as MTI, then
> we would have to rely on merely encouraging implementations to consider
> alternatives.


I tend to take the opposite attitude. The purpose of MTI is to provide a
guaranteed
minimum for interoperabilty, and given that GCM is generally supported, that
seems like the natural choice.

-Ekr



>
> Dave
>
> _______________________________________________
> TLS mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/tls
>