Subject: RE: [TLS] Suite B compliance of TLS 1.2

From: "Blumenthal, Uri" <[email-masked]>
Date: Thu, 27 Jul 2006 09:01:01 -0400

>> I don't entirely understand these statements. Is there a reason
>> why new cipher suites supporting SHA-256, -384, or -512, couldn't
>> be defined using the existing HMAC? 
>>
>> Why doesn't this solve the message integrity issue?
>
> I was wondering the same thing... I.e., why Wan-Teh called
> the issue "controversial". Anyway, I was expecting that
> there would eventually be HMAC-XXX cipher suites.

A. There will be ciphersuite(s) with combined encryption-authentication
AES mode. No issue here.

B. For ciphersuites with no-encryption or AES in encryption-only mode,
HMAC. Suite B specs fail to say what to do, even though the course is
rather obvious.

C. NSA should spell it out explicitly. So perhaps a comment or two to
<mailto:[email-masked]> would do good.

D. [I personally wonder why they stopped short of specifying MAC for
data stream integrity protection. They  specified everything else.]

_______________________________________________
TLS mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/tls

---

From: Wan-Teh Chang <[email-masked]>
Date: Thu, 27 Jul 2006 18:24:25 -0700

I'd like to explain why I said it may be controversial
to define new cipher suites whose MAC algorithm is Suite
B compliant.

HMAC-SHA-1 is still considered secure in spite of the
recent collision attack against SHA-1.  So I suspect
that some people may object to defining new HMAC-SHA-256
and HMAC-SHA-384 cipher suites simply because HMAC-SHA-1,
or rather SHA-1, is not in Suite B.

Wan-Teh Chang

---

From: Vipul Gupta <[email-masked]>
Date: Thu, 27 Jul 2006 18:36:16 -0700

In RFC 4231 (standards track), we already have a
precedence for the IETF embracing HMAC-SHA-256 etc
so there might not be any controversy after all.

vipul