Re: [TLS] Consensus Call on MTI Algorithms

Aaron Zauner <> Fri, 03 April 2015 10:52 UTC

Return-Path: <>
Received: from localhost ( []) by (Postfix) with ESMTP id F04341A879F for <>; Fri, 3 Apr 2015 03:52:00 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -2.6
X-Spam-Status: No, score=-2.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7] autolearn=ham
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id EMarlUgFrrKp for <>; Fri, 3 Apr 2015 03:51:59 -0700 (PDT)
Received: from ( []) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by (Postfix) with ESMTPS id 4FFD21A879B for <>; Fri, 3 Apr 2015 03:51:59 -0700 (PDT)
Received: by wibgn9 with SMTP id gn9so136236078wib.1 for <>; Fri, 03 Apr 2015 03:51:57 -0700 (PDT)
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=20130820; h=x-gm-message-state:message-id:date:from:user-agent:mime-version:to :cc:subject:references:in-reply-to:content-type; bh=EFbsRsfNtvFcVg/Be6LLjv5SrBSEJdhdWMZPEYQQZkU=; b=YW5RT+fI1bEnJghz0tZyP7EGjduFycT9LBX+Wspx7g/wiQamT7HlFG3qZsv5nmCjHm 00Ft0SI9Wr/p0+1xOk/BTwlEjq71jd4EdK3GZpkZAs4JPFwWpNTx5DuIVkpiCQ9v9LNZ wSQ4+13SOnGVvRlLMqa/RbJVn6TL7PRGvAR3zDSUe4YxReoqo7+YpcC8uLAoRF2PN6Du 1uM5PDorYiygUgcEs3/lWGKWOEg1ROQJqCjohDXXAyyksOzUQMQcZaverHANDHfMS4Rv H+wCQYoYRN50xbFwyRyxCuxhb7ZPDyR1zDXEf4BsnPkXwQb2nMvpzr21oY214VKdBKt7 umRw==
X-Gm-Message-State: ALoCoQkkfDAo57jTc4XIJgCyOjy4HLF3EzaJfcsgLz/4Co1vNxh8aqgM73+FPSO1k/W7/2CZL1Z2
X-Received: by with SMTP id lf6mr3707550wjb.78.1428058317869; Fri, 03 Apr 2015 03:51:57 -0700 (PDT)
Received: from [] ( []) by with ESMTPSA id gy9sm2229404wib.12.2015. (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Fri, 03 Apr 2015 03:51:56 -0700 (PDT)
Message-ID: <>
Date: Fri, 03 Apr 2015 12:51:53 +0200
From: Aaron Zauner <>
User-Agent: Postbox 3.0.11 (Macintosh/20140602)
MIME-Version: 1.0
To: Peter Gutmann <>
References: <>, <> <>
In-Reply-To: <>
X-Enigmail-Version: 1.2.3
Content-Type: multipart/signed; micalg="pgp-sha512"; protocol="application/pgp-signature"; boundary="------------enigCC37BDDD379C9113A6AF17AC"
Archived-At: <>
Cc: "" <>
Subject: Re: [TLS] Consensus Call on MTI Algorithms
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Fri, 03 Apr 2015 10:52:01 -0000


Peter Gutmann wrote:
> I've always liked OCB, and the removal of encumbrance for TLS implementations
> finally makes it available for use there.  GCM is just too brittle, a minor
> implementation flaw (as has already occurred in things like tarsnap and JCE)
> leads to a complete loss of security, while the same flaw using CBC (and
> presumably OCB) leads to mostly theoretical weaknesses.  GCM (or at least its
> underlying primitive, CTR) is RC4 all over again, and we're already seeing
> some of the same mistakes that killed RC4 use appearing in GCM deployments.

I think CBC-ETM or OCB would be quite a good fit when native
instructions for AES aren't supported on a given platform. Of course
ChaCha20/Poly1305 gives us a very nice AEAD construction for these as
well. But then we're down to one algorithm for all common platforms that
don't have AESNI. I'd like to see a second MTI cipher for these devices
which, these days, are everywhere (not talking about IoT but rather
smartphones, tons of smartphones and some netbook-like computers). And
I'm not just saying this because I have a draft for AES-OCB, if we end
up with e.g. CBC-ETM or another cipher entirely that's fine as well.

IPRs on OCB:

IBM folks are telling me they're working on something similar as
rogaway's statement regarding TLS. Let's see with what they come up with.