Subject: [TLS] Way forward on fixing CBC Mode

From: Eric Rescorla <[email-masked]>
Date: Sun, 29 Dec 2013 15:14:47 -0800

Based on mailing list discussions and a number of 1:1 discussions,
including consultation with our AD, here is where the chairs think we
are with fixing CBC mode:

* While a number of people in the meeting were in favor of new cipher
suites, much of the list discussion favored an orthogonal signal that
modified all the cipher suites at once. Overall, the dominant
sentiment seems to be that people like and/or can live with an
orthogonal signal that modifies the record protection construction for
CBC mode only (i.e., that leaves AEAD and stream cipher modes
untouched).

* We do not have consensus on this exact construction. There seem to
be two major proposals:

 - Encrypt-then-MAC [draft-gutmann-tls-encrypt-then-mac-05]
 - Pad-MAC-Encrypt [draft-mavrogiannopoulos-new-tls-padding-00]

Based on mailing list discussion, we believe that there is likely to
be consensus for Encrypt-then-MAC, but we want to confirm this.

* What signal to use. Again, there are two proposals:

 - A TLS extension [draft-gutmann-tls-encrypt-then-mac-05,
                    draft-mavrogiannopoulos-new-tls-padding-00]
 - An SCSV [proposed by Martin Rex; no draft yet.]

* A number of WG participants expressed a desire to deprecate
CBC mode entirely. We will need to discuss this for TLS 1.3.

Any proposal here will need to have some story about how to prevent
downgrade attacks. This comes for free with the SCSV but needs
something separate for an extension.

We will be starting two separate threads to discuss these issues and
hope to quickly converge on consensus on these issues (please do not
follow up to this message with discussion of those issues). Assuming
that happens, we'll either propose adoption of an existing draft
(perhaps with appropriate modifications) or solicit a new draft from
proponents of whatever approach does have consensus. Our target is to
have a WG draft by end of January and have a WGLC by London.

-Ekr
[For the chairs]