Subject: [TLS] Numbers used in TLS (AKA IANA considerations)

From: [email-masked]
Date: Thu, 21 Oct 2004 11:02:57 +0300

Hi everyone,

Since Eric urged me to pick some numbers for TLS-PSK soon, I decided
to update the list of numbers currently in use (or at least proposed
somewhere) from my earlier email in April. The list now contains more
historical information; most of that work is presumably dead, and does
not need to prevent future allocation of those numbers. (Corrections
and additions are of course welcome!)

Based on this, I'd suggest that TLS-PSK should use ciphersuite numbers 
starting from 0x8A (there are some unused holes before that, though),
and alert number 115. Any objections or comments to that?

While doing this, I also noticed some collisions:

- TLS extension number 6 is used by both draft-ietf-tls-ecc-06 
  and draft-ietf-tls-srp-08.

- TLS extension number 7 is used both by draft-ietf-tls-ecc-06
  and draft-ietf-tls-openpgp-keys-05.

- Ciphersuites 0x60-0x65 are proposed in draft-lee-tls-seed-00,
  but these numbers are used by "RSA1024" ciphersuites which
  are quite widely implemented.

- Ciphersuites 0x50-0x58 are used in draft-ietf-tls-srp-08, but 
  some OpenSSL versions use those for ECC (and these were also
  used in earlier versions of draft-ietf-tls-ecc).

- Ciphersuites 0x77 and 0x78 are used in draft-ietf-openpgp-keys-05,
  but some OpenSSL versions use those for ECC.

Best regards,
Pasi

---------------------------------------------------------------------------

TLS numbers used in various places
Pasi Eronen <[email-masked]>
Last updated: October 21st, 2004

TLS CIPHERSUITE NUMBERS
=======================

00,00   TLS_NULL_WITH_NULL_NULL                         [RFC2246]
00,01   TLS_RSA_WITH_NULL_MD5                           [RFC2246]
00,02   TLS_RSA_WITH_NULL_SHA                           [RFC2246]
00,03   TLS_RSA_EXPORT_WITH_RC4_40_MD5                  [RFC2246]
00,04   TLS_RSA_WITH_RC4_128_MD5                        [RFC2246]
00,05   TLS_RSA_WITH_RC4_128_SHA                        [RFC2246]
00,06   TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5              [RFC2246]
00,07   TLS_RSA_WITH_IDEA_CBC_SHA                       [RFC2246]
00,08   TLS_RSA_EXPORT_WITH_DES40_CBC_SHA               [RFC2246]
00,09   TLS_RSA_WITH_DES_CBC_SHA                        [RFC2246]
00,0A   TLS_RSA_WITH_3DES_EDE_CBC_SHA                   [RFC2246]
00,0B   TLS_DH_DSS_EXPORT_WITH_DES40_CBC_SHA            [RFC2246]
00,0C   TLS_DH_DSS_WITH_DES_CBC_SHA                     [RFC2246]
00,0D   TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA                [RFC2246]
00,0E   TLS_DH_RSA_EXPORT_WITH_DES40_CBC_SHA            [RFC2246] 
00,0F   TLS_DH_RSA_WITH_DES_CBC_SHA                     [RFC2246]
00,10   TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA                [RFC2246]
00,11   TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA           [RFC2246]
00,12   TLS_DHE_DSS_WITH_DES_CBC_SHA                    [RFC2246]
00,13   TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA               [RFC2246]
00,14   TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA           [RFC2246]
00,15   TLS_DHE_RSA_WITH_DES_CBC_SHA                    [RFC2246]
00,16   TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA               [RFC2246]
00,17   TLS_DH_anon_EXPORT_WITH_RC4_40_MD5              [RFC2246]
00,18   TLS_DH_anon_WITH_RC4_128_MD5                    [RFC2246]
00,19   TLS_DH_anon_EXPORT_WITH_DES40_CBC_SHA           [RFC2246]
00,1A   TLS_DH_anon_WITH_DES_CBC_SHA                    [RFC2246]
00,1B   TLS_DH_anon_WITH_3DES_EDE_CBC_SHA               [RFC2246]
00,1C   (permanently reserved)                          [ssl3]
00,1D   (permanently reserved)                          [ssl3]
00,1E   TLS_KRB5_WITH_DES_CBC_SHA                       [RFC2712], [*1]
00,1F   TLS_KRB5_WITH_3DES_EDE_CBC_SHA                  [RFC2712] 
00,20   TLS_KRB5_WITH_RC4_128_SHA                       [RFC2712] 
00,21   TLS_KRB5_WITH_IDEA_CBC_SHA                      [RFC2712] 
00,22   TLS_KRB5_WITH_DES_CBC_MD5                       [RFC2712] 
00,23   TLS_KRB5_WITH_3DES_EDE_CBC_MD5                  [RFC2712] 
00,24   TLS_KRB5_WITH_RC4_128_MD5                       [RFC2712] 
00,25   TLS_KRB5_WITH_IDEA_CBC_MD5                      [RFC2712] 
00,26   TLS_KRB5_EXPORT_WITH_DES_CBC_40_SHA             [RFC2712] 
00,27   TLS_KRB5_EXPORT_WITH_RC2_CBC_40_SHA             [RFC2712] 
00,28   TLS_KRB5_EXPORT_WITH_RC4_40_SHA                 [RFC2712] 
00,29   TLS_KRB5_EXPORT_WITH_DES_CBC_40_MD5             [RFC2712] 
00,2A   TLS_KRB5_EXPORT_WITH_RC2_CBC_40_MD5             [RFC2712] 
00,2B   TLS_KRB5_EXPORT_WITH_RC4_40_MD5                 [RFC2712] 
00,2C
00,2D
00,2F   TLS_RSA_WITH_AES_128_CBC_SHA                    [RFC3268]
00,30   TLS_DH_DSS_WITH_AES_128_CBC_SHA                 [RFC3268]
00,31   TLS_DH_RSA_WITH_AES_128_CBC_SHA                 [RFC3268]
00,32   TLS_DHE_DSS_WITH_AES_128_CBC_SHA                [RFC3268]
00,33   TLS_DHE_RSA_WITH_AES_128_CBC_SHA                [RFC3268]
00,34   TLS_DH_anon_WITH_AES_128_CBC_SHA                [RFC3268]
00,35   TLS_RSA_WITH_AES_256_CBC_SHA                    [RFC3268]
00,36   TLS_DH_DSS_WITH_AES_256_CBC_SHA                 [RFC3268]
00,37   TLS_DH_RSA_WITH_AES_256_CBC_SHA                 [RFC3268]
00,38   TLS_DHE_DSS_WITH_AES_256_CBC_SHA                [RFC3268]
00,39   TLS_DHE_RSA_WITH_AES_256_CBC_SHA                [RFC3268]
00,3A   TLS_DH_anon_WITH_AES_256_CBC_SHA                [RFC3268]
00,3B                                                   [*10]
00,3C                                                   [*10]
00,3D                                                   [*10]
00,3E                                                   [*10]
00,3F                                                   [*10]
00,40                                                   [*10]
00,41   (reserved for ongoing work)                     [camellia-05]
00,42   (reserved for ongoing work)                     [camellia-05]
00,43   (reserved for ongoing work)                     [camellia-05]
00,44   (reserved for ongoing work)                     [camellia-05]
00,45   (reserved for ongoing work)                     [camellia-05]
00,46   (reserved for ongoing work)                     [camellia-05]
00,47                                                   [*2]
00,48                                                   [*2]
00,49                                                   [*2]
00,4A                                                   [*2]
00,4B                                                   [*2]
00,4C                                                   [*2]
00,4D                                                   [*2]
00,4E                                                   [*2]
00,4F                                                   [*2]
00,50   (reserved for ongoing work)                     [srp-08], [*3]
00,51   (reserved for ongoing work)                     [srp-08], [*3]
00,52   (reserved for ongoing work)                     [srp-08], [*3]
00,53   (reserved for ongoing work)                     [srp-08], [*3]
00,54   (reserved for ongoing work)                     [srp-08], [*3]
00,55   (reserved for ongoing work)                     [srp-08], [*3]
00,56   (reserved for ongoing work)                     [srp-08], [*3]
00,57   (reserved for ongoing work)                     [srp-08], [*3]
00,58   (reserved for ongoing work)                     [srp-08], [*3]
00,59                                                   [*2] 
00,5A                                                   [*2]
00,5B                                                   [*2]
00,5C                                                   [*2]
00,5D
00,5E
00,5F
00,60   TLS_RSA_EXPORT1024_WITH_RC4_56_MD5              [*4,7]
00,61   TLS_RSA_EXPORT1024_WITH_RC2_CBC_56_MD5          [*4,7,12]
00,62   TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA             [56bit] [*7,12]
00,63   TLS_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA         [56bit] [*7,12]
00,64   TLS_DHE_DSS_EXPORT1024_WITH_RC4_56_SHA          [56bit] [*7,12]
00,65   TLS_DHE_DSS_EXPORT1024_WITH_RC4_56_SHA          [56bit] [*7,12]
00,66   TLS_DHE_DSS_WITH_RC4_128_SHA                    [56bit] [*12]
00,67                                                   [*12]
00,68                                                   [*12]
00,69
00,6A
00,6B
00,6C
00,6D
00,6E
00,6F
00,70                                                   [*16]
00,71                                                   [*16]
00,72   (reserved for ongoing work)                     [openpgp-05] [*16]
00,73   (reserved for ongoing work)                     [openpgp-05] [*16]
00,74   (reserved for ongoing work)                     [openpgp-05] [*16]
00,75                                                   [*16]
00,76                                                   [*16]
00,77   (reserved for ongoing work)                     [openpgp-05] [*3,16]
00,78   (reserved for ongoing work)                     [openpgp-05] [*3,16]
00,79   (reserved for ongoing work)                     [openpgp-05] [*16]
00,7A
00,7B
00,7C   (reserved for ongoing work)                     [openpgp-05]
00,7D   (reserved for ongoing work)                     [openpgp-05]
00,7E   (reserved for ongoing work)                     [openpgp-05]
00,7F
00,80   (reserved for ongoing work)                     [cptls-01]
00,81   (reserved for ongoing work)                     [cptls-01]
00,82   (reserved for ongoing work)                     [cptls-01]
00,83   (reserved for ongoing work)                     [cptls-01]
00,84   (reserved for ongoing work)                     [camellia-05]
00,85   (reserved for ongoing work)                     [camellia-05]
00,86   (reserved for ongoing work)                     [camellia-05]
00,87   (reserved for ongoing work)                     [camellia-05]
00,88   (reserved for ongoing work)                     [camellia-05]
00,89   (reserved for ongoing work)                     [camellia-05]
01,01                                                   [*14]
01,02                                                   [*14]
01,03                                                   [*14]
01,04                                                   [*14]
01,05                                                   [*14]
01,06                                                   [*14]
01,10                                                   [*14]
01,20                                                   [*14]
01,21                                                   [*14]
01,22                                                   [*14]
01,23                                                   [*14]
01,24                                                   [*14]
01,25                                                   [*14]
01,F0                                                   [*14]
FF,E0   (reserved)                                      [fips]
FF,E1   (reserved)                                      [fips]
FE,FE   (reserved)                                      [fips]
FE,FF   (reserved)                                      [fips]

TLS CONTENT TYPES
=================

  20    change_cipher_spec                  [RFC2246]
  21    alert                               [RFC2246]
  22    handshake                           [RFC2246]
  23    application_data                    [RFC2246]
  24                                        [*9]

TLS HANDSHAKE TYPES
===================

   0    hello_request                       [RFC2246]
   1    client_hello                        [RFC2246]
   2    server_hello                        [RFC2246]   
   3                                        [*5]
   4                                        [*5]
  11    certificate                         [RFC2246]
  12    server_key_exchange                 [RFC2246]
  13    certificate_request                 [RFC2246]
  14    server_hello_done                   [RFC2246]
  15    certificate_verify                  [RFC2246]
  16    client_key_exchange                 [RFC2246]
  20    finished                            [RFC2246]
  21    certificate_url                     [RFC3546]
  22    certificate_status                  [RFC3546]
  78                                        [ia-00]
  79                                        [ia-00]

TLS ALERT DESCRIPTIONS
======================

   0    close_notify                        [RFC2246]
  10    unexpected_message                  [RFC2246]
  20    bad_record_mac                      [RFC2246]
  21    decryption_failed                   [RFC2246]
  22    record_overflow                     [RFC2246]
  30    decompression_failure               [RFC2246]
  40    handshake_failure                   [RFC2246]
  41    (permanently reserved)              [ssl3], [*13]
  42    bad_certificate                     [RFC2246]
  43    unsupported_certificate             [RFC2246]
  44    certificate_revoked                 [RFC2246]
  45    certificate_expired                 [RFC2246]
  46    certificate_unknown                 [RFC2246]
  47    illegal_parameter                   [RFC2246]  
  48    unknown_ca                          [RFC2246]
  49    access_denied                       [RFC2246]
  50    decode_error                        [RFC2246]
  51    decrypt_error                       [RFC2246]
  60    export_restriction                  [RFC2246]
  70    protocol_version                    [RFC2246]
  71    insufficient_security               [RFC2246]
  80    internal_error                      [RFC2246]
  90    user_canceled                       [RFC2246]
 100    no_renegotiation                    [RFC2246]
 110    unsupported_extension               [RFC3546] [*13]
 111    certificate_unobtainable            [RFC3546] [*13]
 112    unrecognized_name                   [RFC3546] [*13]
 113    bad_certificate_status_response     [RFC3546] [*13]
 114    bad_certificate_hash_value          [RFC3546]
 120    (reserved for ongoing work)         [srp-08] [*13]
 121    (reserved for ongoing work)         [srp-08]
 122    (reserved for ongoing work)         [srp-08]
 208                                        [ia-00] [*6]

TLS CLIENT CERTIFICATE TYPES
============================

   1    rsa_sign                            [RFC2246]
   2    dss_sign                            [RFC2246]
   3    rsa_fixed_dh                        [RFC2246]
   4    dss_fixed_dh                        [RFC2246]
   5    (permanently reserved)              [ssl3] [*16]
   6    (permanently reserved)              [ssl3] [*15]
   7                                        [*15]
   8                                        [*11,15]
   9                                        [*11,15]
  20    (permanently reserved)              [ssl3]
  21    (reserved for ongoing work)         [cptls-01]
  22    (reserved for ongoing work)         [cptls-01]

TLS EXTENSION TYPES
===================
        
    0   server_name                         [RFC3546]
    1   max_fragment_length                 [RFC3546]
    2   client_certificate_url              [RFC3546]
    3   trusted_ca_keys                     [RFC3546]
    4   truncated_hmac                      [RFC3546]
    5   status_request                      [RFC3546]
    6   (reserved for ongoing work)         [srp-08], [ecc-06], [*5,13]
    7   (reserved for ongoing work)         [openpgp-05], [ecc-06], [*5]
    8                                       [express-00] [*6]
    9                                       [exchange-00], [*6,8]
   35                                       [fast-00] [*6]
37703                                       [ia-00] [*6]
60000                                       [cptls-01] [*6]

REFERENCES AND NOTES
====================

[camellia-05]   Shiho Moriai, Akihiro Kato, and Masayuki Kanda,
                "Addition of Camellia Ciphersuites to Transport Layer
                Security (TLS)", draft-ietf-tls-camellia-05, October
                2004.

[ecc-06]        Vipul Gupta, Simon Blake-Wilson, Bodo Moeller, Chris
                Hawk, and Nelson Bolyard, "ECC Cipher Suites For TLS",
                draft-ietf-tls-ecc-06, May 2004.

[openpgp-05]    Nikos Mavroyanopoulos, "Using OpenPGP keys for TLS
                authentication", draft-ietf-tls-openpgp-keys-05, April
                2004.

[srp-08]        David Taylor, Tom Wu, Nikos Mavroyanopoulos, and
                Trevor Perrin, "Using SRP for TLS Authentication",
                draft-ietf-tls-srp-08, August 2004.

[cptls-01]      Grigorij Chudov and Serguei Leontiev, "Addition of
                GOST Ciphersuites to Transport Layer Security (TLS)",
                draft-chudov-cryptopro-cptls-01, April 2004.

[seed-00]       Hyangjin Lee, Jaeho Yoon, and Jaeil Lee, "Addition of
                SEED Ciphersuites to Transport Layer Security (TLS)",
                draft-lee-tls-seed-00, September 2004.

[express-00]    Mohamad Badra, Ahmed Serhrouchni, and Pascal Urien,
                "TLS Express", draft-badra-tls-express-00, June 2004.

[exchange-00]   Mohamad Badra, Omar Cherkaoui, Ibrahim Hajjeh, and
                Ahmed Serhrouchni, "Pre-Shared-Key key Exchange
                methods for TLS", draft-badra-tls-key-exchange-00,
                August 2004.

[fast-00]       Nancy Cam-Winget, David McGrew, Joseph Salowey, and
                Hao Zhou, "EAP Flexible Authentication via Secure
                Tunneling (EAP-FAST)", draft-cam-winget-eap-fast-00,
                February 2004.

[ia-00]         Paul Funk, Simon Blake-Wilson, Ned Smith, and Hannes
                Tschofenig, "TLS Inner Application Extension (TLS/IA)",
                October 2004.

[ssl3]          Alan O. Freier, Philip Karlton, and Paul C. Kocher,
                "The SSL Protocol Version 3.0", expired I-D
                (draft-freier-ssl-version3-02.txt), November 1996.

[56bit]         John Banes and Richard Harrington, "56-bit Export
                Cipher Suites For TLS", expired Internet-Draft
                draft-ietf-tls-56-bit-ciphersuites-01.txt, July
                2001. Although this document was never published as
                RFC, these ciphersuites are implemented by several
                vendors.

[fips]          FIPS SSL CipherSuites, http://www.mozilla.org/projects/
                security/pki/nss/ssl/fips-ssl-ciphersuites.html

[*1]            This number was previously used for 
                SSL_FORTEZZA_KEA_WITH_RC4_128_SHA in [ssl3]

[*2]            Some versions of OpenSSL have used these numbers
                for elliptic curve ciphersuites.

[*3]            Some versions of OpenSSL have used these numbers
                for elliptic curve ciphersuites, but the same
                numbers are used for other purposes, too.

[*4]            These two ciphersuites were not defined in [56bit], 
                but are implemented by several vendors.

[*5]            These numbers were used in
                draft-shacham-tls-fast-track-00 (Hovav Shacham and Dan
                Boneh, "TLS Fast-Track Session Establishment",
                September 2001), but presumably this work is dead, and
                the numbers can be used for other purposes.

[*6]            These drafts do not appear to be intended for
                standards track; therefore, they should not
                define new TLS extensions or alert numbers,
                at least according to [RFC3546].

[*7]            These numbers are proposed in [seed-00], but
                they are widely used for other purposes.

[*8]            It is expected that [exchange-00] will be 
                superceded by draft-ietf-tls-psk (which does
                not need a TLS extension number), so this
                entry may be deleted soon in the future.

[*9]            This number was in draft-ietf-tls-delegation-01 
                (Keith Jackson, Steven Tuecke, and Doug Engert, "TLS
                Delegation Protocol", February 2002), but presumably
                this work is dead and the number can be reused for
                other purposes.

[*10]           These numbers were used in draft-ietf-tls-misty1-01
                (Hidenori Ohta and Hirosato Tsuji, "Addition of MISTY1
                to TLS", March 2001), but presumably this work is dead
                and the numbers can be reused for other purposes.

[*11]           These numbers were used in draft-ietf-tls-ntru-00 (Ari
                Singer, "NTRU Cipher Suites for TLS", July 2001), but
                presumably this work is dead and the numbers can be
                reused for other purposes.

[*12]           These numbers were used in draft-ietf-tls-ntru-00,
                but presumably this work is dead, and and many of 
                the numbers are widely used for other purposes anyway.

[*13]           These numbers were used in draft-ietf-tls-pathsec-00
                (Joseph Hui, "TLS Pathsec Protocol", September 2001),
                but presumably this work is dead, and the numbers
                can be used for other purposes.

[*14]           These numbers were used in draft-ietf-tls-openpgp-02
                (Will Price and Michael Elkins, "Extensions to TLS for
                OpenPGP keys", February 2002), but presumably this
                work is dead, and the numbers can be used for other
                purposes.

[*15]           These numbers were used in draft-madhu-tls-spki-00
                (H. S. Madhusudhana and V. R. Ramachandran, "SPKI
                Certificate Integration with Transport Layer Security
                (TLS) for Client Authentication and Authorization",
                July 2001), but presumably this work is dead, and the
                numbers can be used for other purposes.

[*16]           These numbers were used in draft-ietf-tls-kerb-01
                (Matthew Hur, Joseph Salowey, and Ari Medvinsky,
                "Kerberos Cipher Suites in Transport Layer Security
                (TLS)", November 2001), but presumably this work is
                dead, and the numbers can be used for other purposes.
                
--------------------------------------------------------------------------

_______________________________________________
TLS mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/tls

---

From: Bodo Moeller <[email-masked]>
Date: Thu, 21 Oct 2004 12:38:54 -0700

[......]
> 00,50   (reserved for ongoing work)                     [srp-08], [*3]
[......]
> 00,58   (reserved for ongoing work)                     [srp-08], [*3]
[......]

>                 numbers are used for other purposes, too.

Thanks for preparing the long list of ciphersuite and other numbers!

There is no actual *version* of OpenSSL using these ciphersuites,
just daily snapshots of work in progress; and because the ECC
ciphersuites are not yet official, they are disabled by default.

In the current TLS ECC draft, the rule for computing the premaster
secret is incompatible with the earliest drafts.  The OpenSSL
development snapshosts currently implement the intermediate drafts,
which are compatible with the earliest drafts and a Certicom
implementation for smaller curves, and with the current draft for
large curves.  Once the TLS ECC specification is assigned actual
ciphersuite numbers, the OpenSSL implementation can be updated
accordingly.  There is no reason to keep the ciphersuite numbers that
are found in earlier TLS ECC drafts or in OpenSSL development snapshots
because the ciphersuites will not interoperate anyway.

So the footnote could read "Used by some OpenSSL development snapshots;
obsoleted by [ecc-06]".

---

From: Vipul Gupta <[email-masked]>
Date: Thu, 21 Oct 2004 14:59:31 -0700

Bodo's comments are also true for another open source
cryptographic library (NSS: Netscape Security Services)
which powers the Mozilla/Firefox/Netscape browsers.
NSS versions 3.8 and 3.9 implement the same ECC ciphersuites
as the OpenSSL snapshots but ECC support in NSS is also
turned off by default. Once the ECC in TLS draft is
finalized, the ECC code in NSS will be updated accordingly.

So the footnote could be further modified to read:

"Used by some OpenSSL development snapshots and NSS 3.8/3.9,
obsoleted by [ecc-06]"

vipul