Re: [TLS] Consensus Call on MTI Algorithms

[Aaron Zauner <[e-mail]>]

Hi,

Peter Gutmann wrote:
> I've always liked OCB, and the removal of encumbrance for TLS implementations
> finally makes it available for use there.  GCM is just too brittle, a minor
> implementation flaw (as has already occurred in things like tarsnap and JCE)
> leads to a complete loss of security, while the same flaw using CBC (and
> presumably OCB) leads to mostly theoretical weaknesses.  GCM (or at least its
> underlying primitive, CTR) is RC4 all over again, and we're already seeing
> some of the same mistakes that killed RC4 use appearing in GCM deployments.

I think CBC-ETM or OCB would be quite a good fit when native
instructions for AES aren't supported on a given platform. Of course
ChaCha20/Poly1305 gives us a very nice AEAD construction for these as
well. But then we're down to one algorithm for all common platforms that
don't have AESNI. I'd like to see a second MTI cipher for these devices
which, these days, are everywhere (not talking about IoT but rather
smartphones, tons of smartphones and some netbook-like computers). And
I'm not just saying this because I have a draft for AES-OCB, if we end
up with e.g. CBC-ETM or another cipher entirely that's fine as well.

IPRs on OCB:
https://datatracker.ietf.org/ipr/search/?draft=&rfc=7253&submit=rfc&holder=&patent=&group=&doctitle=&iprtitle=

IBM folks are telling me they're working on something similar as
rogaway's statement regarding TLS. Let's see with what they come up with.

Aaron