Re: [TLS] Inclusion of OCB mode in TLS 1.3

[Aaron Zauner <[e-mail]>]

Martin Thomson wrote:
> On 13 January 2015 at 09:04, Aaron Zauner <[e-mail]> wrote:
>> Now I'm a bit clueless as to how new AEAD modes are supposed to be
>> added to TLS 1.3.
> 
> 
> In this case, I would suggest writing an Internet Draft describing how
> the cipher suite is identified and how it operates.  That would be a
> relatively short document.
> 
> Unless there are specific reasons not to, a new AEAD cipher should be
> defined for TLS 1.2 as well.  One reason (that doesn't apply to OCB)
> is that it might require non-deterministic padding, for which there is
> a bug in the TLS 1.2 AEAD construction (see
> https://github.com/tlswg/tls13-spec/issues/47).

Thanks for this piece of information! So that would be an ID to the
extent of RFC5288 or RFC6655.

> There are, of course, reasons why people would not want to accept a
> proposal like that.  More cipher suites isn't strictly a good thing.
> Of course, if OCB is demonstrably better in some fashion (speed,
> security, whatever it happens to be), then that makes the case easier.

Generally I would agree, but I think for now OCB mode would be a very
good addition to AEAD in TLS. Let's see what the CAESAR competition
brings us in 2017,..

Aaron