Re: [TLS] Inclusion of OCB mode in TLS 1.3

[Aaron Zauner <[e-mail]>]

Hi,

Salz, Rich wrote:
>
> We need a cipher cage match.  They call go in, and only a couple come out.
>

I'm not opposed to that. And am sure OCB would win over e.g. CCM. Also:
I'm not suggesting OCB mode should be MTI. That's up to the people
currently spec'ing TLS 1.3. GCM based ciphersuites seem like a good idea
to be MTI. e.g. CCM do not.

BTW: Amazed to find out that GOST is still in use (and still mandatory
for russian gov./banking?).

Nico Williams wrote:
> On Wed, Jan 21, 2015 at 08:15:45AM -0800, Eric Rescorla wrote:
>> On Wed, Jan 21, 2015 at 7:17 AM, Aaron Zauner <[e-mail]> wrote:
>>> Any comments on the idea of removing the following two ciphersuites from
>>> the draft?
>>>
>>>      CipherSuite TLS_DHE_PSK_WITH_AES_128_OCB = {TBD9, TBD9}
>>>      CipherSuite TLS_DHE_PSK_WITH_AES_256_OCB = {TBD10, TBD10}
>>>
>>> I don't see how these would be relevant to embedded devices.
> 
> If DHE_PSK is relevant to an embedded device then all cipher+mode
> combinations might be as well.  Obviously OCB wouldn't be required to
> implement, but that's no reason to exclude any one subset of ciphersuits
> using OCB.

Well. No. Not really. Why would an embedded device prefer to do DHE over
ECDHE? ECC operations are sure to be more efficient on embedded
devices/IoT. That's was my reason to ask for removal.

> 
>> If we generally think DHE_PSK is a good idea, is there a specific
>> reason why it wouldn't be a good idea for OCB?
> 
> There isn't.  Embedded devices need not implement the full set of
> suites.

+1

> But really, this is once more about the gross inefficiency (in terms of
> registration as well as number of bytes used on the wire) of cartesian
> explosion ciphersuites.  Can we fix this?

What's your suggestion to fixing this? I totally agree that there are
far too many ciphersuites around, which is somewhat ironical because I
just suggested adding 10-12 more. But I'd really like to see and use OCB
mode over CCM in TLS. This is also the reason I'm trying to get rid of
as many unnecessary (or insecure) ciphersuites as possible for OCB.

Aaron