Subject: [TLS] Proposed TLS WG recharter

From: Eric Rescorla <[email-masked]>
Date: Thu, 17 Nov 2005 09:31:37 -0800

Here's my proposed TLS WG recharter. Any comments?

-Ekr

Description of Working Group:
Goals and Milestones:
The TLS Working Group has completed a series of specifications
that describe the Transport Layer Security protocol versions
1.0 and 1.1, extensions to the protocol, and new ciphersuites
to be used with TLS.

The primary goal of the WG is to publish a revision of TLS, 
version 1.2,
that removes the protocol's dependency on the MD5 and SHA-1 digest
algorithms, which have been either wholly or partially compromised by
recent research. The TLS WG will also work on adding major new cipher
suites to TLS, including Counter (CTR) and authenticated encryption
modes. In the preparation of TLS 1.2, the Working Group will attempt
to avoid gratuitous changes to TLS 1.1.

Goals and Milestones
-------------------
Done	  	Agreement on charter and issues in current draft.
Done	  	Final draft for Secure Transport Layer Protocol ('STLP')
Done	  	Working group 'Last Call'
Done	  	Submit to IESG for consideration as a Proposed Standard.
Done	  	First revised draft of TLS specification 
3/06		First revised draft of TLS 1.2 specification.
3/06		Submit specification of Counter Mode cipher suites
		to IESG for publication as Proposed Standard.
3/06		First draft of authenticated encryption mode 
cipher suites
		specification.
12/06		Submit specification of TLS 1.2 specification to
		IESG for publication as Proposed Standard.
12/06		Submit specification of authenticated encryption mode
		cipher suites to IESG for publication as Proposed
		Standard.

_______________________________________________
TLS mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/tls

---

From: Bodo Moeller <[email-masked]>
Date: Thu, 17 Nov 2005 11:54:09 -0700

> The primary goal of the WG is to publish a revision of TLS, version
> 1.2, that removes the protocol's dependency on the MD5 and SHA-1
> digest algorithms, which have been either wholly or partially
> compromised by recent research.

Agreed.

> The TLS WG will also work on adding major new cipher suites to TLS,
> including Counter (CTR) and authenticated encryption modes.

I don't quite agree to this: "Adding major new cipher suites" is just
one of the options we have, and this certainly might turn out to be
the best way to proceed.  But another option would be to redefine
existing ciphersuites to use CTR instead of CBC, depending on the
protocol version (like the ciphersuites that now have "SHA" in their
names, referring to SHA-1, may be using something different in TLS 1.2).
The decision between such options must, obviously, be done while TLS
1.2 is being developed.  But I thinks it's much too early to put the
final decision into the charter.

As for "authenticated encryption modes", all TLS 1.1 ciphersuites with
encryption do provide authenticated encryption.  There are other
authenticated encryption modes that are not based on compositions like
the ones in TLS 1.1 and which may be advantageous, and these are
probably what you are referring to, but being "authenticated
encryption modes" is not what is unique about them.  Also it's not
clear (to me) that we really need to put them into TLS, although this
certainly is a reasonable option to consider.

So here's a proposed replacement wording for the above sentence
from your proposed charter:

    The TLS WG will also work on additional authenticated encryption
    modes for TLS, including modes based on counter mode encryption
    (CTR), and may define major new cipher suites for TLS for this
    purpose.

---

From: Brian Minard <[email-masked]>
Date: Wed, 23 Nov 2005 09:57:55 -0500

On Thu, Nov 17, 2005 at 09:31:37AM -0800, Eric Rescorla wrote:

> compromised by recent research. The TLS WG will also work on
> adding major new cipher suites to TLS, including Counter (CTR) and
> authenticated encryption modes. In the preparation of TLS 1.2, the
> Working Group will attempt to avoid gratuitous changes to TLS 1.1.

Can you comment on your position WRT introducing multiple PRFs? Clearly
the proposed wording includes the rework of the existing PRF, but it's
an open question whether the scope of the charter includes provision for
more than one hash algorithm migration (i.e., from SHA-1/MD5 to SHA-256
to some other algorithm).