Re: [TLS] WG adoption + early code point assignment: draft-mavrogiannopoulos-chacha-tls

[Nikos Mavrogiannopoulos <[e-mail]>]

----- Original Message -----
> I am in favor of this draft.
> 
> Prior to doing the code point assignment, however, we should resolve
> the question of the per-record nonce algorithm. The current draft uses
> an algorithm that is not consistent either with the algorithm we use for
> GCM or TLS 1.3.
> 
> - TLS 1.2 GCM: 32-bit fixed salt || 64-bit explicit per-record IV
> - TLS 1.3: fixed mask XORed with the record sequence number
> - ChaCha: 32-bit fixed salt || record sequence number

I think the chacha draft is consistent with the TLS 1.2 GCM draft. The TLS
1.2 GCM draft allows as an option (MAY) to have "32-bit fixed salt || record sequence number",
and in fact all implementations do that. So this draft simply ratifies that
approach and changes that requirement to MUST. The approach in TLS 1.3 is a novel 
one and I don't think it suits this draft.
 
regards,
Nikos