[TLS] Comments on tales from the TLS interim: TLS 1.3 MTI algorithms

[KATO Akihiro <[e-mail]>]

Hi All．

I will comment TLS 1.3 MTI. I'm holding the following points of view.

(a) To be avoided Single points of failure,
(b) If possible, back up algorithm suitable for low spec system,
(c) Second point algorithm developed by different concept.

> o Symmetric:
>     MUST AES-GCM 128
>     [SHOULD ChaCha20-Poly1305]

I have no objection, it is AES-GCM is a MUST. Protocols used DTLS (fg.
CoAP) can not deploy by ChaCha20, which is not second point cipher for
AES. MTI will have second point block cipher using CCM.

> o Hash:
>     MUST SHA-256
MTI will have another algorithm, but we do not have candidate.

> o Signature:
>     MUST ECDSA P-256
>     MUST RSA
     MUST ECDSA P-256
     SHOULD RSA

>From point of view (b), I wiil hold ECDSA P-256. RSA move to SHOULD.

Regards.