Re: [TLS] Inclusion of OCB mode in TLS 1.3

[Aaron Zauner <[e-mail]>]

Nikos Mavrogiannopoulos wrote:
> I don't see why OCB has to be tied to TLS 1.3. The last time such move
> was made with having GCM/AEAD restricted to TLS 1.2, it proved quite
> wrong (in the sense that not doing it would have avoided the majority of
> the problems we saw the last years). TLS 1.3 is a draft document to be
> deployed in 2-3 years after published (in the best case scenario). There
> is no reason the existing implementations cannot take advantage of OCB,
> if ever defined. 
> 
I'm trying to find a compromise between having to pollute the TLS
ciphersuite registry with tons of ciphersuites (as has been pointed out
to me is not desirable) and OCB being deployable in the real world for
implementors that would like to use it (and are allowed to w.r.t. it's
licensing).

If the majority is for a) dropping the idea b) having OCB in >= TLS 1.2,
and thus tons of ciphersuites or c) for TLS 1.3 applicable ciphersuites
only - I'll draft it that way.

Having this discussion beforehand will also save time on editing the
draft all the time, in case on is to be written.

I'm open for any suggestions and some consensus on the topic would be nice.

Aaron