Subject: [TLS] Summary of MTI discussion

From: Joseph Salowey <[email-masked]>
Date: Tue, 19 May 2015 13:56:21 -0700

Below is a summary of the current state of the MTI discussions.   I expect
the details will evolve over time, but some of the main actions are a call
for adoption for the ChaCha20 and Curve25519 drafts and removal of non
elliptic curve DSA from TLS 1.3.  The call for adoptions will come in
separate messages.

Thanks,

J&S

o Symmetric:
        AES-GCM 128 - Consensus  to Support MUST
        ChaCha20-Poly1305 - Consensus seems to be somewhere between a
SHOULD and a MUST
        AES-GCM-256 -  rough consensus for SHOULD to match UTA draft

o Hash:
        SHA-256 - Consensus for MUST
        SHA-384 - rough consensus for SHOULD to match UTA draft

o Key Agreement: ECDH
        P-256 - Consensus for MUST
        25519 - Consensus seems to be somewhere between a SHOULD and a MUST

o Signature:
        DSA - consensus to remove
        RSA - consensus for a MUST but need more detail on hash and
signature algorithms  Perhaps RSA-PSS with SHA-256 and SHA-384
        ECDSA P-256 - seems as if there is a consensus for a MUST, need
more detail on hash and signature algorithms - ECDSA with SHA-256 and
SHA-384
        Other signature algorithms are TBD

Cheers,

Joe

---

From: Dave Garrett <[email-masked]>
Date: Tue, 19 May 2015 19:17:35 -0400

>         25519 - Consensus seems to be somewhere between a SHOULD and a MUST

The doc currently has an inline "OPEN ISSUE: Triage curve list." (doesn't appear to be a separate issue filed for it) So, in addition to MTI and any other additions, a list to remove support for should also be compiled. I'm guessing at least all <224bit would be on the chopping block. I don't think the specifics of this got discussed on list yet.

Dave