Subject: [ietf-tls] Query on draft-ietf-tls-ciphersuite-03.txt

From: "Walker, Jesse" <[email-masked]>
Date: Fri, 9 Feb 2001 10:23:33 -0800

The document specifies CBC mode for 128- and 256-bit AES. Why? Why not
counter mode? It appears TLS could experience a big boost in performance
without sacrificing any security by changing this. Feedback modes like CBC
squander AES's ability to exploit the parallelism available in modern
processors, while counter mode is fully parallizable; and TLS seems to have
the right properties to make counter mode just as safe as CBC mode. I don't
understand what tradeoffs have led to the selection of CBC mode.

-- Jesse

---
You are currently subscribed to ietf-tls as: [email-masked]
To unsubscribe send a blank email to [email-masked]

---

From: David Hopwood <[email-masked]>
Date: Fri, 09 Feb 2001 22:47:36 +0000

-----BEGIN PGP SIGNED MESSAGE-----

"Walker, Jesse" wrote:
> without sacrificing any security by changing this.

Not really, because HMAC is still not parallelisable. IMHO we should wait
until there is a good candidate for a fully parallelisable ciphersuite.
Several possible candidate modes were presented at the AES modes conference
(see http://csrc.nist.gov/encryption/modes/ and
http://csrc.nist.gov/encryption/modes/workshop1/), but they should really
have a bit more analysis, as well as sorting out patent issues in some
cases.

- -- 
David Hopwood <[email-masked]>

Home page & PGP public key: http://www.users.zetnet.co.uk/hopwood/
RSA 2048-bit; fingerprint 71 8E A6 23 0E D3 4C E5  0F 69 8C D4 FA 66 15 01
Nothing in this message is intended to be legally binding. If I revoke a
public key but refuse to specify why, it is because the private key has been
seized under the Regulation of Investigatory Powers Act; see www.fipr.org/rip

---