Subject: [TLS] tales from the TLS interim: TLS 1.3 MTI algorithms

From: Sean Turner <[email-masked]>
Date: Tue, 17 Mar 2015 18:11:32 -0400

All,

This message summarizes the TLS 1.3 MTI (mandatory to implement) discussions we had at the Seattle TLS Interim meeting.  We’ll also be discussing this in Dallas so this is just an FYI message.

A couple of things to keep in mind:

1. Anything in [] is predicated on the CFRG proceeding on their current course.  In other words, we are not telling the CFRG these are what we want we’re just trying to read the tea leaves.

2. We fully expect that there will be profiles for specific environments.

3. MTI is not mandatory to use.

o Symmetric:
	MUST AES-GCM 128
	[SHOULD ChaCha20-Poly1305]

o Hash:
	MUST SHA-256

o Key Agreement: ECDH
	MUST P-256
	[SHOULD 25519]

o Signature:
	MUST ECDSA P-256
	MUST RSA

On a related note, we also discussed which curves to keep in the base specification; when text from RFC 4492 was incorporated it included ~25 curves.  The code points will still exist they just won’t be in the base spec.  The 4492-list would be pruned to P-256 and  P-384 and then obviously expanded to add [25519] and [448].

spt

---

From: Yoav Nir <[email-masked]>
Date: Wed, 18 Mar 2015 09:38:28 +0200

> On Mar 18, 2015, at 12:11 AM, Sean Turner <[email-masked]> wrote:
> 
> All,
> 

Please note that CFRG is already done with ChaCha20-Poly1305. The document is approved and in the RFC Editor’s queue.

The ball is not in this working group’s court. It’s time to decide about draft-mavrogiannopoulos-chacha-tls.

Yoav

http://tools.ietf.org/html/draft-mavrogiannopoulos-chacha-tls-04

---

From: Rob Stradling <[email-masked]>
Date: Wed, 18 Mar 2015 09:11:44 +0000

>> On Mar 18, 2015, at 12:11 AM, Sean Turner <[email-masked]> wrote:
<snip>
> The ball is not in this working group’s court. It’s time to decide about draft-mavrogiannopoulos-chacha-tls.

Yoav,

s/not/now/

?

-- 
Rob Stradling
Senior Research & Development Scientist
COMODO - Creating Trust Online

---

From: Yoav Nir <[email-masked]>
Date: Wed, 18 Mar 2015 13:52:24 +0200

> On Mar 18, 2015, at 11:11 AM, Rob Stradling <[email-masked]> wrote:
> 

Yeah. Sorry about that.

---

From: Aaron Zauner <[email-masked]>
Date: Wed, 18 Mar 2015 19:15:55 +0100

Hi,

> 	MUST RSA

Was there any discussion on adding [EdDSA]?

Thanks,
Aaron

---

From: Eric Rescorla <[email-masked]>
Date: Wed, 18 Mar 2015 11:19:31 -0700

> Was there any discussion on adding [EdDSA]?

My understanding is that CFRG hasn't even really taken signatures yet,
so the feeling was that even discussing it was premature.

-Ekr

---

From: Aaron Zauner <[email-masked]>
Date: Wed, 18 Mar 2015 19:29:38 +0100

Hi,

> so the feeling was that even discussing it was premature.

Correct. It came up a couple of times recently, but I don't see CFRG
recommending a specific signature scheme very soon as well.

Thanks for the update.

Aaron

---

From: Eric Rescorla <[email-masked]>
Date: Wed, 18 Mar 2015 14:05:25 -0700

On Wed, Mar 18, 2015 at 2:11 AM, Rob Stradling <[email-masked]>
wrote:

>> Please note that CFRG is already done with ChaCha20-Poly1305. The
>> document is approved and in the RFC Editor’s queue.
>>
I await the chair's action on this.

In the meantime, I see that we have developed a conflict between this draft
and

https://github.com/tlswg/tls13-spec/pull/155

Because this PR prescribes a specific mechanism for generating the nonce
(left-padding the record sequence number) which conflicts with the one for
this draft. Assuming that people feel that the approach we arrived at in
the interim is appropriate, we will probably want to adjust this draft prior
to acceptance.

-Ekr

Yoav,
> _______________________________________________
> TLS mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/tls
>

---

From: Yoav Nir <[email-masked]>
Date: Thu, 19 Mar 2015 00:55:58 +0200

> On Mar 18, 2015, at 11:05 PM, Eric Rescorla <[email-masked]> wrote:
> 
> 
> On Wed, Mar 18, 2015 at 2:11 AM, Rob Stradling <[email-masked] <mailto:[email-masked]>> wrote:
> On Mar 18, 2015, at 12:11 AM, Sean Turner <[email-masked] <mailto:[email-masked]>> wrote:
> <snip>
> In the meantime, I see that we have developed a conflict between this draft and
> 
> https://github.com/tlswg/tls13-spec/pull/155 <https://github.com/tlswg/tls13-spec/pull/155>
> 

The draft is suitable for TLS 1.2 as well, so I’m not sure it needs to comply with the nonce generation procedure of TLS 1.3.  It’s better for it to be like other AEADs such as AES-GCM, and then get adapted to TLS 1.3 just like AES-GCM.

Yoav

---

From: Eric Rescorla <[email-masked]>
Date: Wed, 18 Mar 2015 16:01:23 -0700

On Wed, Mar 18, 2015 at 3:55 PM, Yoav Nir <[email-masked]> wrote:

> The draft is suitable for TLS 1.2 as well, so I’m not sure it needs to
> comply with the nonce generation procedure of TLS 1.3.  It’s better for it
> to be like other AEADs such as AES-GCM, and then get adapted to TLS 1.3
> just like AES-GCM.
>

Well, it's already not like GCM because the GCM draft uses a partially
explicit nonce (64 bits) that is carried separately in the record whereas
this draft uses the record sequence number in that location. What I am
proposing is that instead of using an IV generated from the master secret
as the upper 32 bits of the nonce, ChaCha20 should just use 0s. This
would make it like TLS 1.3.

Alternately, I suppose you could make it like GCM, but it seems like the
WG is moving towards saving those bits, so that seems odd.

-Ekr

---

From: Sean Turner <[email-masked]>
Date: Thu, 19 Mar 2015 08:28:39 -0400

> The ball is not in this working group’s court. It’s time to decide about draft-mavrogiannopoulos-chacha-tls.

Yesterday I sent a heads up to the authors of the draft you referenced.  This is going to be one of the topics of discussion the chairs will raise during the status portion of our welcome/agenda/bash/status slides.

spt