Subject: [ietf-tls] TLS: AES draft and OAEP

From: Win Treese <[email-masked]>
Date: Fri, 22 Jun 2001 15:38:22 -0400

From the discussion of OAEP for the AES ciphersuites, I draw the
following conclusions:

1. RSA with OAEP is a cryptographically better mechanism for use in TLS
2. It would be good if TLS and other protocols in the Security Area
   could share more cryptographic foundations
3. Since we expect AES to be important, this is a good (and rare)
   opportunity to use RSA with OAEP in TLS

but

4. Implementers object because there is more work to be done
5. It's a big deal for hardware accelerators because they're harder to
   change than software

On balance, it seems to me that it's a change worth making, then.
Unless I missed a crucial argument, I'm asking Pete Chown to modify
the draft accordingly.

There will be another WG last call on the draft to review the new
language. 

Thanks to everyone for an engaging discussion,

Win Treese
Chair, TLS working group
[email-masked]

---
You are currently subscribed to ietf-tls as: [email-masked]
To unsubscribe send a blank email to [email-masked]

---

From: [email-masked] (Nelson Bolyard)
Date: Fri, 22 Jun 2001 14:29:32 -0700

> 5. It's a big deal for hardware accelerators because they're harder to

Yes, it means sites that depend on existing accelerators won't be able to 
deploy suites that use OAEP any time soon.

> Unless I missed a crucial argument, I'm asking Pete Chown to modify

So, are you asking that all AES suites require OAEP?
Or, are you asking for two sets of suites, one with OAEP and one without? 
or ??

--
Nelson Bolyard               Sun / Netscape Alliance
Disclaimer:                  I speak for myself, not for Netscape

---

---

From: David Hopwood <[email-masked]>
Date: Fri, 22 Jun 2001 21:12:33 +0100

-----BEGIN PGP SIGNED MESSAGE-----

> 1. RSA with OAEP is a cryptographically better mechanism for use in TLS

I have explained several times why RSA with OAEP provides no security
benefit over PKCS #1 v1.5 with the RFC 2246 fix. It can be proven that
the fixed PKCS #1 v1.5, as used in TLS, is secure against chosen ciphertext
attack in the random oracle model, in fact with a tighter reduction than
the one in the corrected OAEP proof.

If the WG wants to support OAEP purely for buzzword-compliance, there's
not much I can do about that, but it won't help security.

- -- 
David Hopwood <[email-masked]>

Home page & PGP public key: http://www.users.zetnet.co.uk/hopwood/
RSA 2048-bit; fingerprint 71 8E A6 23 0E D3 4C E5  0F 69 8C D4 FA 66 15 01
Nothing in this message is intended to be legally binding. If I revoke a
public key but refuse to specify why, it is because the private key has been
seized under the Regulation of Investigatory Powers Act; see www.fipr.org/rip

---

---

From: Pete Chown <[email-masked]>
Date: Sat, 23 Jun 2001 16:38:16 +0100

> Or, are you asking for two sets of suites, one with OAEP and one without? 

I believe the suggestion is that all AES suites will require OAEP.
What is your/Netscape's view of that?

-- 
Pete

---