Re: [TLS] Confirming Consensus on supporting only AEAD ciphers

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

On 29.04.2014 19:33, Michael D'Errico wrote:
> Martin Thomson wrote:
>>> I suggest [not naming a mandatory-to-implement cipher suite in the
>>> TLS 1.3 spec.].  There are too many [cipher suites] to choose from
>>> and nobody will listen anyway.
>>
>> That's a recipe for interoperability failure.
>
> I'm suggesting that the TLS 1.3 spec. is not the place for this piece
> of information since it is a moving target:
>
>     TLS 1.0 required TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA.
>     TLS 1.1 required TLS_RSA_WITH_3DES_EDE_CBC_SHA.
>     TLS 1.2 required TLS_RSA_WITH_AES_128_CBC_SHA
>
> Current consensus says none of those previously-mandatory ciphers will
> even be compatible with TLS 1.3.
>
> A Best Current Practice document like draft-sheffer-tls-bcp-02 that
> tracks best practices is more useful than having the TLS spec. become
> obsolete soon after it's published.  BTW that draft suggests these
> cipher suites:
>
>     TLS_DHE_RSA_WITH_AES_128_GCM_SHA256
>     TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
>     TLS_DHE_RSA_WITH_AES_256_GCM_SHA384
>     TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
>
> Mike
>
> _______________________________________________
> TLS mailing list
> TLS@ietf.org
> https://www.ietf.org/mailman/listinfo/tls
>

There are good reasons why not to use AES-GCM in software implementation
of TLS

https://www.imperialviolet.org/2012/10/21/nist.html
https://www.imperialviolet.org/2013/10/07/chacha20.html

Chacha20+Poly1305 is more efficient on CPUs without special instructions
to implement AES and GCM. Also secure implementation which doesn't leaks
timing information on such CPUs is easier.

Fedor

-----BEGIN PGP SIGNATURE-----

iQJ8BAEBCgBmBQJTaKo6XxSAAAAAAC4AKGlzc3Vlci1mcHJAbm90YXRpb25zLm9w
ZW5wZ3AuZmlmdGhob3JzZW1hbi5uZXQ4QkVFQ0NBRDcyNzU1RTk2RTQwMzlEQjc2
RTE3NDA5NTQwNTY2M0FEAAoJEG4XQJVAVmOt47sQAJN2v9TIpA+1eEcJoK0yIEem
cKhPpZaYwKhKnthk4RYnV/hBFn6/Ij59p14Als+e5ZdMLB6uiqwurgEoRi7OKZRK
QFKyhrqOrjqX2UrhKbPY6wPJ+WY+Qq8PA8OA0KAp3etSTgcopaCTBEUSUkaMiqiG
RJ8MzrzyQQALPP+/gODaBIa0MF8y2jOdqAqn7IUaKM9auYeSwEaRzMfhKFITvrkC
a/YZnEB1KkqezKvxocAUw3ttV2kAiFJyGPHPA3GB0nUamw3CUspFIBIuZ9sjv1OW
ih90AfsobMdm1lZrZwn1WHdValUKYy3VRg2NEH+AgLfhaMbnOgBlCBR3c1edxhAX
Dl6o8VmAI0HAOYKWhLxC9NkpPPbOqXJk8r29R+Ch89fdXHXmRMJ9StK5LKP+gKCx
qvVIK3Dp3ITxB5jULX6O1mrI6oGKRpirwlD3ixNujJ+wmc4AmJ3ALiniWOPv6b3T
wn/4jikp2IkUnddVyMZOaYSjpflhcnO/WOA0p0nmtprIyD61FQ5w6MMPoEkcXOfz
ngMxYS9Pr0+OwbaAhkaJpbXLre3Txc/JcW1Bi/z7o/MCWqApkAW5xhQrKUcDRzNb
ToJ5CX9beSvQHr90H7o/JbNsivJEim9vLLWO7yOiC1Gv/LYHhoElc7fk4o/t1kWG
WFxsQZshTrSIZArecUVb
=avO6
-----END PGP SIGNATURE-----