Subject: Re: [TLS] WGLC for draft-ietf-tls-ecdhe-psk-aead

From: Russ Housley <[email-masked]>
Date: Tue, 20 Dec 2016 09:45:53 -0500

> This is the working group last call for the "ECDHE_PSK with AES-GCM and AES-CCM CSs for TLS” draft

I am curious about the choice of hash function for TLS_ECDHE_PSK_WITH_AES_256_CCM_8_SHA256.  All of the other AES-256 ciphersuites defined in this document that use SHA-384.  Why does the one with a truncated authentication tag use SHA-256?

The Security Consideration includes:

   Use of Pre-Shared Keys of limited entropy (for example, a PSK that is
   relatively short, or was chosen by a human and thus may contain less
   entropy than its length would imply) may allow an active attacker to
   perform a brute-force attack where the attacker attempts to connect
   to the server and tries different keys.

Given the mention of passwords, it seems that dictionary attacks should also be mentioned.

Russ

---

From: Martin Thomson <[email-masked]>
Date: Wed, 21 Dec 2016 12:24:53 +1100

> I am curious about the choice of hash function for TLS_ECDHE_PSK_WITH_AES_256_CCM_8_SHA256.  All of the other AES-256 ciphersuites defined in this document that use SHA-384.  Why does the one with…

I would go further than Russ and challenge the value of the
ciphersuite entirely.  Though I think that we've already discussed
this before, several times.

For some reason I can't remember ever having had my mind changed on
this point, though I think John pointed at the larger key size having
some advantage with respect to (mumble), even if you aren't concerned
about active forgery.