Subject: [TLS] Confirming Consensus on supporting only AEAD ciphers

From: "Joseph Salowey (jsalowey)" <[email-masked]>
Date: Wed, 26 Mar 2014 18:43:07 +0000

TLS has supported a number of different cipher types for protecting the record layer.   In TLS 1.3 these include Stream Cipher, CBC Block Cipher and AEAD Cipher.  The construction of the CBC mode within TLS has been shown to be flawed and stream ciphers are not generally applicable to DTLS. Using a single mechanism for cryptographic transforms would make security analysis easier.   AEAD ciphers can be constructed from stream ciphers and block ciphers and are defined as protocol independent transforms.  The consensus in the room at IETF-89 was to only support AEAD ciphers in TLS 1.3. If you have concerns about this decision please respond on the TLS list by April 11, 2014.

Thanks,

Joe
[Speaking for the TLS chairs]

---

From: Russ Housley <[email-masked]>
Date: Thu, 27 Mar 2014 02:32:27 -0400

I'd like to ask a clarifying question.

Please look at RFC 6476.  In that document, Peter Gutmann uses traditional encryption and integrity functions to make an AEAD cipher.  Does this decision allow or prohibit such ciphers?

Russ

---

From: "Joseph Salowey (jsalowey)" <[email-masked]>
Date: Thu, 27 Mar 2014 14:59:07 +0000

> Please look at RFC 6476.  In that document, Peter Gutmann uses traditional encryption and integrity functions to make an AEAD cipher.  Does this decision allow or prohibit such ciphers?

[Joe]  The AEAD specification is TLS 1.2 is built from RFC 5116.  This does not restrict the type of algorithms used to build the AEAD cipher  as long as the result  meets RFC 5116.   I'm not sure that RFC 6476 can be used directly, but you should be able to build an AEAD cipher out of the same algorithms.  

Is your concern using RFC 6476 exactly or just being able to build a TLS compliant AEAD mode out of traditional functions?