Subject: Re: [TLS] AAED ciphers: AES-GCM vs AES-EAX/AES-CCM: a meta-analysis

From: Peter Gutmann <[email-masked]>
Date: Tue, 6 Jan 2015 10:24:39 +0000

Michael Clark <[email-masked]> writes:

>A TLSv1.3 ClientHello and ServerHello extensions could advertise something
>like this this:

Ugh, not, we don't need yet more extensions and complexity, we just need a
single set of options that everyone uses (see Grigg's Law, "There is only one
cipher suite and that is #1").

Peter.

---

From: Michael Clark <[email-masked]>
Date: Tue, 06 Jan 2015 21:30:13 +0800

> cipher suite and that is #1").

I have some alternative ideas. You probably won't like them ;-)

There are different dimensions of simplicity and complexity relating to
composition and layering.

I think the worst problem with TLS is supporting backwards compatibility.

There is a possibility to add symmetry and reduce complexity. I just
posted about HMAC on handshakes and some other comments, that may
actually mean Encrypt-then-MAC is needed, and you just have hmac_null in
the common case where you are satisfied with the 128-bit tag from the
AEAD cipher.

* handshake
    ETM-AEAD[null,hmac_sha2_256]

* application data
    ETM-AEAD[aead-cipher,hmac_null]

* application data with extended authentication
    ETM-AEAD[aead-cipher,hmac_sha2_256]