Re: [TLS] Consensus Call on MTI Algorithms

On Fri, Apr 3, 2015 at 8:10 AM, Dave Garrett <davemgarrett@gmail.com> wrote:

> On Friday, April 03, 2015 09:55:32 am Watson Ladd wrote:
> > On Apr 2, 2015 11:49 AM, "Nico Williams" <nico@cryptonector.com> wrote:
> > > On Wed, Apr 01, 2015 at 11:12:19AM -0700, Joseph Salowey wrote:
> > > > o Symmetric:
> > > >         MUST AES-GCM 128
> > > >         SHOULD ChaCha20-Poly1305
> > >
> > > I would like at least two modes for AES to be required: one AEAD
> > > (probably GCM) and one AEAD-by-generic-construction (e.g., using HMAC).
> >
> > OCB is a better fit constrained devices. CCM requires two passes.
>
> So, at this point in the discussion, this is sounding like what might get
> closer to agreement:
>
> o Symmetric:
>         MUST AES-OCB 128 (or 256?)
>         MUST ChaCha20-Poly1305
>         OPTIONAL AES-GCM 128, but MUST if supporting TLS 1.2
>

I would not be in favor of this. I prefer the proposal that the chairs
originally made
based on the interim.

-Ekr

This is essentially 2 MTI for TLS 1.3, with a required amendment to the TLS
> 1.2 spec to add an AEAD MTI. Without this, when falling back a version
> there'd be a higher likelihood of having to downgrade to CBC. (current
> draft has a SHOULD for using AEAD with TLS 1.2, if available)
>
> The question is, however: is the WG willing to specify two new MTI? Not
> having one that's currently in widespread use might slow adoption. Then
> again, ChaChaPoly is getting out there from Google's pushing of it. Or, all
> 3 could just be MUSTs.
>
>
> Dave
>
> _______________________________________________
> TLS mailing list
> TLS@ietf.org
> https://www.ietf.org/mailman/listinfo/tls
>