[TLS] Inclusion of OCB mode in TLS 1.3

[Aaron Zauner <[e-mail]>]

Hi TLS-WG,

Over the last couple of days I've again looked into OCB, read the
original paper as well as quite some literature on it, patents, CFRG
discussion et cetera.

OCB looks like an elegant and parallel mode for inclusion in TLS.
I've searched through recent TLS-WG discussion, OCB has been
mentioned in passing as has EAX(2). When first looking into that my
main concerns were:

   * IPR/patents: the authors have granted access to OSI licensed
     software as well as to commercial (non military!) software for
     all use [0] [1].

   * IETF applicability: an informational RFC has been written by
     the original author of OCB mode, reviewed and accepted by CFRG
     and published by IESG in May 2014 [RFC7253].

   * Software implementations: OCB mode is available in various
     cryptographic libraries:

      - OpenSSL's 1.0.2 branch

(https://github.com/openssl/openssl/blob/0c1bd7f03fcd1cc8256f89f4962d91b78432c74a/crypto/modes/ocb128.c)

      - Bouncy Castle
        (https://www.bouncycastle.org/specifications.html)

      - Botan

(https://github.com/randombit/botan/tree/74522169a907715d4d41b3680f20b6f866733de7/src/lib/modes/aead/ocb)

      - Soon; dynamic languages linking to these libraries.

      - I might have left out a few, where I couldn't find a
        clear indication that they intend to support OCB mode.

From looking at [RFC7253] it would make sense to have;
`AEAD_AES_128_OCB_TAGLEN64` and `AEAD_AES_256_OCB_TAGLEN128` in TL3
1.3 ciphersuites.

Now I'm a bit clueless as to how new AEAD modes are supposed to be
added to TLS 1.3. In the past there have been various documents
extending TLS ciphersuites by a certain block cipher/AEAD mode:
[RFC5288] [RFC6367] [RFC6655] [RFC5528] [RFC6209]. There is a
general document for an interface for AEAD modes [RFC5116] which the
authors have used for their informational RFC [RFC7253]. I'd like to
ask for a bit of guidance how this can be done more efficiently for
all ciphers that will end up in TLS 1.3. Having a seperate RFC for
every cipher and thus ciphersuite seems a bit confusing. Is this the
intended approach still?

I'd be willing to author such a document or make the necessary
changes to the TLS 1.3 draft in order to get OCB mode into TLS 1.3.
Currently we're limited to GCM (with known issues on mobile
plattforms) and CCM (CBC-MAC, which is one of the reasons the OCB
authors started work on this mode, because it's more elegant and
efficient).


Recent developments regarding OCB mode are documented here:
http://web.cs.ucdavis.edu/~rogaway/ocb/news/

All and any input appreciated.

Thanks,
Aaron

[0] https://www.ietf.org/mail-archive/web/cfrg/current/msg03301.html
[1] http://web.cs.ucdavis.edu/~rogaway/ocb/ocb-faq.htm#patent:phil