Subject: [TLS] removing cipher suites for 1.2

From: Hovav Shacham <[email-masked]>
Date: Fri, 2 Nov 2007 15:53:27 -0700

Hi, all --

I'd like to propose that we remove some cipher suites from TLS 1.2.   
The goal is to reduce the number of choices to keep people from  
making the wrong ones, and to reduce the amount of complexity in the  
main TLS standard overall.

My philosophy is that we should think that everything in the main TLS  
standard is a good idea and worth implementing.

In particular, I'd like to discourage the use of single-DES, IDEA,  
and anything export-strength.

This gives the following cipher suites, I believe:

     CipherSuite TLS_RSA_WITH_IDEA_CBC_SHA              = { 0x00,0x07 };
     CipherSuite TLS_RSA_WITH_DES_CBC_SHA               = { 0x00,0x09 };
     CipherSuite TLS_DH_DSS_WITH_DES_CBC_SHA            = { 0x00,0x0C };
     CipherSuite TLS_DH_RSA_WITH_DES_CBC_SHA            = { 0x00,0x0F };
     CipherSuite TLS_DHE_DSS_WITH_DES_CBC_SHA           = { 0x00,0x12 };
     CipherSuite TLS_DHE_RSA_WITH_DES_CBC_SHA           = { 0x00,0x15 };
     CipherSuite TLS_DH_anon_WITH_DES_CBC_SHA           = { 0x00,  
0x1A };

     CipherSuite TLS_RSA_EXPORT_WITH_RC4_40_MD5         = { 0x00,0x03 };
     CipherSuite TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5     = { 0x00,0x06 };
     CipherSuite TLS_RSA_EXPORT_WITH_DES40_CBC_SHA      = { 0x00,0x08 };
     CipherSuite TLS_DH_DSS_EXPORT_WITH_DES40_CBC_SHA   = { 0x00,0x0B };
     CipherSuite TLS_DH_RSA_EXPORT_WITH_DES40_CBC_SHA   = { 0x00,0x0E };
     CipherSuite TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA  = { 0x00,0x11 };
     CipherSuite TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA  = { 0x00,0x14 };
     CipherSuite TLS_DH_anon_EXPORT_WITH_RC4_40_MD5     = { 0x00,0x17 };
     CipherSuite TLS_DH_anon_EXPORT_WITH_DES40_CBC_SHA  = { 0x00,0x19 };

I'd suggest that these numbers be marked as reserved to avoid  
backward-compatibility problems.

I'd also suggest removing some of the values from the  
BulkCipherAlgorithm enum, specifically rc2, des, des40, and idea.

Cheers --
Hovav Shacham.

_______________________________________________
TLS mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/tls

---

From: [email-masked] (Peter Gutmann)
Date: Sat, 03 Nov 2007 16:24:17 +1300

Hovav Shacham <[email-masked]> writes:

>In particular, I'd like to discourage the use of single-DES, IDEA, and
>anything export-strength.

Just as a data point, about:config indicates that these are disabled by
default in Firefox so there's pretty good evidence there that there's no
problem in removing them.

Peter.

---

From: "Wan-Teh Chang" <[email-masked]>
Date: Sat, 3 Nov 2007 17:33:42 -0700

> problem in removing them.

I believe that these are also disabled in IE7 on Windows Vista.
See http://blogs.msdn.com/ie/archive/2006/03/15/552246.aspx

Wan-Teh

---

From: <[email-masked]>
Date: Mon, 5 Nov 2007 13:05:49 +0200

The "export strength" cipher suites were already removed in TLS 1.1.

I guess single-DES is also obsolete, and IDEA isn't very 
widely used either...

Best regards,
Pasi

> -----Original Message-----
> From: ext Hovav Shacham [mailto:[email-masked]] 
> Sent: 03 November, 2007 00:53
> To: [email-masked]
> Subject: [TLS] removing cipher suites for 1.2
> 
> Hi, all --
> 
>

---

From: Martin Rex <[email-masked]>
Date: Thu, 8 Nov 2007 00:41:59 +0100 (MET)

> main TLS standard overall.

I don't understand you request.  They have been removed from TLS 1.2
(from the protocol, not from the specification document, that is).

What is _NOT_ clear about the last paragraph(s) of Section A.5
of the current TLS v1.2 draft (draft-ietf-tls-rfc4346-bis-06.txt):

   When SSLv3 and TLS 1.0 were designed, the United States restricted
   the export of cryptographic software containing certain strong
   encryption algorithms. A series of cipher suites were designed to
   operate at reduced key lengths in order to comply with those
   regulations. Due to advances in computer performance, these
   algorithms are now unacceptably weak and export restrictions have
!  since been loosened. TLS 1.2 implementations MUST NOT negotiate these
!  cipher suites in TLS 1.2 mode. However, for backward compatibility
   they may be offered in the ClientHello for use with TLS 1.0 or SSLv3
   only servers. TLS 1.2 clients MUST check that the server did not
   choose one of these cipher suites during the handshake. These
   ciphersuites are listed below for informational purposes and to
   reserve the numbers.

My impression is that there is a significant installed base that
doesn't have TLS v1.1, so removing them from the specifiction
document doesn't seem like a good idea to me.  I'm already very
uncomfortable with "silent" backwards-incompatible changes in
the SSLv3->TLSv1.x protocol revisions that requires implementors
to read all documents individually and find out the backward
incompatible changes on their own.

Regards,
-Martin

---

From: Hovav Shacham <[email-masked]>
Date: Wed, 7 Nov 2007 15:59:10 -0800

> (from the protocol, not from the specification document, that is).

First, I am proposing that more cipher suites than just the export  
cipher suites be removed.  Single-DES and IDEA are not export- 
strength ciphers.

>    ciphersuites are listed below for informational purposes and to

I don't disagree that this is okay, but I would prefer that TLS 1.2  
implementations be required never to list export cipher specs in the  
ClientHello.  I do not see the downside to redefining these cipher  
spec numbers as reserved.

However, I would be willing to live with the current export language  
if we can apply it to single-DES and IDEA as well.

Cheers --
Hovav.

---

From: Martin Rex <[email-masked]>
Date: Thu, 8 Nov 2007 01:22:22 +0100 (MET)

> cipher suites be removed.  Single-DES and IDEA are not export- 

For the original SSLv3 (spec dated Nov-1996) the EXPORT grade
was 40-bit.

IIRC, the single-DES ciphersuites were added to accomodate
the raised US crypto-export regulations somewhere around 1999/2000,
but the period wasn't long enough and the issue not significant
enough to deserve "EXPORT" labelling in any of the documents.

I don't recall that IDEA was ever called weak, but it has always been
esoteric because it had been patent-encumbered (the patent may have
expired by now, but I don't know).

> spec numbers as reserved.

I will strongly object to a requirement that would require TLSv1.2
implementations to significantly impair interoperability with
the installed base of TLSv1.0 or SSLv3.  A policy option to that effect
at the discretion of a consumer of this technology is OK, but
not an implementation requirement to impair interoperability.

-Martin

---

From: Hovav Shacham <[email-masked]>
Date: Wed, 7 Nov 2007 18:07:01 -0800

> enough to deserve "EXPORT" labelling in any of the documents.

So, single DES is weak -- due to its small keyspace -- and should not  
be negotiated.

> esoteric

For block ciphers, "esoteric" means "weak."  IDEA should not be  
negotiated.

Cheers --
Hovav.

---

From: <[email-masked]>
Date: Thu, 8 Nov 2007 09:31:40 +0200

> enough to deserve "EXPORT" labelling in any of the documents.

The single-DES ciphersuites were present already in SSLv2 and SSLv3,
around 1994/1995 (and were in all TLS 1.0 drafts, as well).

Best regards,
Pasi

---

From: [email-masked] (Peter Gutmann)
Date: Fri, 09 Nov 2007 15:12:15 +1300

Martin Rex <[email-masked]> writes:

>esoteric because it had been patent-encumbered (the patent may have expired
>by now, but I don't know).

The first patents were issued in 1991, so it's got a while to go yet.  However
even if was unencumbered, you've got a cipher designed for circa-1990
processors, full of complex 16-bit operations that are a right pain on RISC
32-bit and 64-bit CPUs.  The only reason it's still in there is because PGP
2.x used it.

Peter.