Subject: [TLS] Comments on tales from the TLS interim: TLS 1.3 MTI algorithms

From: KATO Akihiro <[email-masked]>
Date: Tue, 24 Mar 2015 03:21:39 +0900

Hi All．

I will comment TLS 1.3 MTI. I'm holding the following points of view.

(a) To be avoided Single points of failure,
(b) If possible, back up algorithm suitable for low spec system,
(c) Second point algorithm developed by different concept.

> o Symmetric:
>     MUST AES-GCM 128
>     [SHOULD ChaCha20-Poly1305]

I have no objection, it is AES-GCM is a MUST. Protocols used DTLS (fg.
CoAP) can not deploy by ChaCha20, which is not second point cipher for
AES. MTI will have second point block cipher using CCM.

> o Hash:
>     MUST SHA-256
MTI will have another algorithm, but we do not have candidate.

> o Signature:
>     MUST ECDSA P-256
>     MUST RSA
     MUST ECDSA P-256
     SHOULD RSA

>From point of view (b), I wiil hold ECDSA P-256. RSA move to SHOULD.

Regards.

---

From: Eric Rescorla <[email-masked]>
Date: Mon, 23 Mar 2015 13:49:16 -0500

> AES. MTI will have second point block cipher using CCM.

Why can't DTLS do ChaCha20?

-Ekr

> _______________________________________________
> TLS mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/tls
>

---

From: Ilari Liusvaara <[email-masked]>
Date: Mon, 23 Mar 2015 20:56:14 +0200

> Why can't DTLS do ChaCha20?

I presume KATO Akihiro meant that constrained systems can't do Chacha20,
not that AEAD #29 (Chacha20-Poly1305) has any special problems with
doing DTLS.

-Ilari

---

From: Yoav Nir <[email-masked]>
Date: Mon, 23 Mar 2015 14:05:27 -0500

> On Mar 23, 2015, at 1:56 PM, Ilari Liusvaara <[email-masked]> wrote:
> 

I don’t know why that would be true. The state for ChaCha20 is 64 bytes (16 32-bit integers) with Poly1305 probably rounding it up to a little over 80, and only about 32 of those need to be kept between packets. AES-GCM requires an expanded key and ghash table that total over 800 bytes. The code for both ChaCha and Poly is small enough for even the most constrained systems. Of course if you anyway have the AES-GCM code, the ChaCha code is extra, but I don’t think it’s a big issue for even the 20 KB class of device.

Yoav