Subject: Re: [TLS] Last Call: <draft-ietf-tls-ecdhe-psk-aead-03.txt> (ECDHE_PSK with AES-GCM and AES-CCM Cipher Suites for Transport Layer Security (TLS)) to Proposed Standard

From: Simon Friedberger <[email-masked]>
Date: Thu, 4 May 2017 23:58:47 +0200

Nits:

	RFC 4279 reference is missing.

	"TLS 1.3 and above version, " should probably be "TLS 1.3 and above" or "TLS 1.3 and higher versions"

On 04/05/17 18:41, The IESG wrote:
> The IESG has received a request from the Transport Layer Security WG
> (tls) to consider the following document:
> - 'ECDHE_PSK with AES-GCM and AES-CCM Cipher Suites for Transport Layer
>    Security (TLS)'
>   <draft-ietf-tls-ecdhe-psk-aead-03.txt> as Proposed Standard
>
> The IESG plans to make a decision in the next few weeks, and solicits
> final comments on this action. Please send substantive comments to the
> [email-masked] mailing lists by 2017-05-18. Exceptionally, comments may be
> sent to [email-masked] instead. In either case, please retain the
> beginning of the Subject line to allow automated sorting.
>
> Abstract
>
>
>    This document defines several new cipher suites for the Transport
>    Layer Security (TLS) protocol.  The cipher suites are all based on
>    the Ephemeral Elliptic Curve Diffie-Hellman with Pre-Shared Key
>    (ECDHE_PSK) key exchange together with the Authenticated Encryption
>    with Associated Data (AEAD) algorithms AES-GCM and AES-CCM.  PSK
>    provides light and efficient authentication, ECDHE provides perfect
>    forward secrecy, and AES-GCM and AES-CCM provides encryption and
>    integrity protection.
>
>
>
>
> The file can be obtained via
> https://datatracker.ietf.org/doc/draft-ietf-tls-ecdhe-psk-aead/
>
> IESG discussion can be tracked via
> https://datatracker.ietf.org/doc/draft-ietf-tls-ecdhe-psk-aead/ballot/
>
>
> No IPR declarations have been submitted directly on this I-D.
>
>
>
>
> _______________________________________________
> TLS mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/tls

---

From: Daniel Migault <[email-masked]>
Date: Thu, 18 May 2017 17:45:38 +0000

Hi Simon, 

Thank you for the review. I believe we have addressed your comments in our version 04. Please see my comments inline. 

Yours, 
Daniel

-----Original Message-----
From: TLS [mailto:[email-masked]] On Behalf Of Simon Friedberger
Sent: Thursday, May 04, 2017 5:59 PM
To: [email-masked]
Cc: [email-masked]
Subject: Re: [TLS] Last Call: <draft-ietf-tls-ecdhe-psk-aead-03.txt> (ECDHE_PSK with AES-GCM and AES-CCM Cipher Suites for Transport Layer Security (TLS)) to Proposed Standard

Nits:

	RFC 4279 reference is missing.
MGLT: It seems the reference is mentioned in the current version in the Normative reference as well  as in the introduction at line 127,  in section 3 line 143. In case you meant another reference, please let us know. 

	"TLS 1.3 and above version, " should probably be "TLS 1.3 and above" or "TLS 1.3 and higher versions"
MGLT: Changed to "TLS 1.3 and higher versions"

On 04/05/17 18:41, The IESG wrote:
> [email-masked] mailing lists by 2017-05-18. Exceptionally, comments may 
> be sent to [email-masked] instead. In either case, please retain the

---

From: Timothy Jackson <[email-masked]>
Date: Thu, 18 May 2017 20:52:04 +0000

One small nit.

> ECDHE provides perfect forward secrecy
I thought we had decided to change “perfect forward secrecy” to just “forward secrecy” since “perfect” is such a difficult standard to reach?

Tim
—
Tim Jackson | Product Security Architect | MobileIron, Inc.

On 5/18/17, 10:45 AM, "TLS on behalf of Daniel Migault" <[email-masked] on behalf of [email-masked]> wrote:

    Hi Simon, 

    Yours, 
    Daniel
    
    -----Original Message-----
    From: TLS [mailto:[email-masked]] On Behalf Of Simon Friedberger
    Sent: Thursday, May 04, 2017 5:59 PM
    To: [email-masked]
    Cc: [email-masked]
    Subject: Re: [TLS] Last Call: <draft-ietf-tls-ecdhe-psk-aead-03.txt> (ECDHE_PSK with AES-GCM and AES-CCM Cipher Suites for Transport Layer Security (TLS)) to Proposed Standard
    
    Nits:

---

From: "Blumenthal, Uri - 0553 - MITLL" <[email-masked]>
Date: Thu, 18 May 2017 21:01:02 +0000

It is a mathematical cryptographic term, and as such is incontrovertible. 

I say leave it in.

Regards,
Uri

Sent from my iPhone

> On May 18, 2017, at 16:58, Timothy Jackson <[email-masked]> wrote:
> 
> One small nit.
>

---

From: Daniel Migault <[email-masked]>
Date: Thu, 18 May 2017 17:17:19 -0400

Hi,

Thanks Tim and Uri for the comment. At least wikipedia considers them as
equivalent. I am fine either way, but leave it  as pfs unless there is a
consensus to change it to forward secrecy. If having fs seems important to
you please let us know asap!

Yours,
Daniel

On Thu, May 18, 2017 at 5:01 PM, Blumenthal, Uri - 0553 - MITLL <
[email-masked]> wrote:

> > I thought we had decided to change “perfect forward secrecy” to just
> “forward secrecy” since “perfect” is such a difficult standard to reach?
> >
> > Tim
> > —
> > On 5/18/17, 10:45 AM, "TLS on behalf of Daniel Migault" <
> [email-masked] on behalf of [email-masked]> wrote:
> >
> >    Hi Simon,
> >
> >    Thank you for the review. I believe we have addressed your comments
> in our version 04. Please see my comments inline.
> >
> >    Yours,
> >    Daniel
> >
> >    Subject: Re: [TLS] Last Call: <draft-ietf-tls-ecdhe-psk-aead-03.txt>
> (ECDHE_PSK with AES-GCM and AES-CCM Cipher Suites for Transport Layer
> Security (TLS)) to Proposed Standard
> >
> >    Nits:
> >
> >    MGLT: It seems the reference is mentioned in the current version in
> the Normative reference as well  as in the introduction at line 127,  in
> section 3 line 143. In case you meant another reference, please let us know.
> >
> >
> >

---

From: "Blumenthal, Uri - 0553 - MITLL" <[email-masked]>
Date: Thu, 18 May 2017 21:22:14 +0000

Instead of our in addition to the Wiki, check scholarly references. E.g., Introduction to Modern Cryptography, Handbook of Applied Cryptography, etc.

Regards,
Uri

Sent from my iPhone

> On May 18, 2017, at 17:18, Daniel Migault <[email-masked]> wrote:
> 
> Hi, 
> 
> Thanks Tim and Uri for the comment. At least wikipedia considers them as equivalent. I am fine either way, but leave it  as pfs unless there is a consensus to change it to forward secrecy. If having fs seems important to you please let us know asap!
> 
> Yours, 
> Daniel 
> 
>> On Thu, May 18, 2017 at 5:01 PM, Blumenthal, Uri - 0553 - MITLL <[email-masked]> wrote:

---

From: Eric Rescorla <[email-masked]>
Date: Thu, 18 May 2017 17:30:54 -0400

I don't much care, but we've moved to "forward secrecy" in TLS 1.3.

-Ekr

On Thu, May 18, 2017 at 5:17 PM, Daniel Migault <[email-masked]
> wrote: