Subject: [TLS] Inclusion of OCB mode in TLS 1.3

From: Phillip Rogaway <[email-masked]>
Date: Wed, 14 Jan 2015 15:02:54 -0800 (Pacific Standard Time)

A couple of colleagues were kind enough to tell me that there 
were discussions going on on this mailing list about including 
OCB in TLS 1.3; but that there were still some IP-related 
concerns.  I'd like to quell those as best I can.  So let 
me go on record as indicating that I think it would be great 
if TLS supported OCB; and that I'm happy to freely and 
automatically license any IP of mine for OCB under TLS.

I suspect that most use-cases for TLS-with-OCB would 
already be covered by one of the prior patent-grants 
I've done.  But, for anything that might fall in a gap, 
the simplest thing, I suspect, is for me to do an 
"IETF Patent Disclosure and Licensing Declaration" 
specifying royalty-free licensing for use of OCB in 
compliance with a TLS-specifying RFC.  I'm happy to 
submit one of those.  I might need some help to identify
what RFC number(s) to cite.

Thanks for all your hard work on advancing crypto
standards and improving TLS.

phil

---

From: Peter Gutmann <[email-masked]>
Date: Thu, 22 Jan 2015 08:18:51 +0000

Aaron Zauner <[email-masked]> writes:

>Any comments on the idea of removing the following two ciphersuites from the
>draft?
>
>     CipherSuite TLS_DHE_PSK_WITH_AES_128_OCB = {TBD9, TBD9}
>     CipherSuite TLS_DHE_PSK_WITH_AES_256_OCB = {TBD10, TBD10}

Those cipher suites are really good ones, they give you PFS, mutual auth of
both parties, and OCB.  Why would you remove exactly those two?

Peter.