Re: [TLS] About encrypting SNI

[Andy Lutomirski <[e-mail]>]

On Wed, Apr 16, 2014 at 7:29 PM, Paul Lambert <[e-mail]> wrote:
>
>
> On 4/16/14, 11:32 AM, "James Cloos" <[e-mail]> wrote:
>
>>>>>>> "AL" == Andy Lutomirski <[e-mail]> writes:
>>
>>AL> US-governement-preferred choice: ECIES/Elligator Squared on P-256,
>>AL> with AES-128-GCM.
>>
>>DJB's parallel paper (http://cr.yp.to/snuffle/bruteforce-20050425.pdf)
>>implies all should s/AES-128/AES-256/g.  Especialy when there is a
>>significant quantity of traffic available for probabilistic attacks.
> These type of parallel HW attacks are facilitated by CCM/GCM modes.
> AES-SIV would not be easily mapped into such a attack.

Let's focus on the handshake encryption part, as opposed to the actual
selection of cipher suite.  After all, I think it's pretty clear that
acceptable cipher suites exist, and selecting them won't be terribly
hard.

FWIW, the chosen AEAD construction needs to be indistinguishable from
random, too.  GCM should be okay: the tag is the encryption of a
plaintext block that should only occur once for the lifetime of a key.
 Poly1305, at least as it's likely to be instantiated, should be okay
for the same reason: the tag is the sum of two effectively independent
terms mod 2^128, and one of those terms is indistinguishable from
random.

--Andy