Subject: Re: [TLS] Confirming Consensus on supporting only AEAD ciphers

From: Fedor Brunner <[email-masked]>
Date: Tue, 06 May 2014 11:24:10 +0200

On 29.04.2014 19:33, Michael D'Errico wrote:
> Martin Thomson wrote:
>>> I suggest [not naming a mandatory-to-implement cipher suite in the
>>> TLS 1.3 spec.].  There are too many [cipher suites] to choose from
>>> and nobody will listen anyway.
>>
>> That's a recipe for interoperability failure.
>
> I'm suggesting that the TLS 1.3 spec. is not the place for this piece
> of information since it is a moving target:
>
>     TLS 1.0 required TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA.
>     TLS 1.1 required TLS_RSA_WITH_3DES_EDE_CBC_SHA.
>     TLS 1.2 required TLS_RSA_WITH_AES_128_CBC_SHA
>
> Current consensus says none of those previously-mandatory ciphers will
> even be compatible with TLS 1.3.
>
> A Best Current Practice document like draft-sheffer-tls-bcp-02 that
> tracks best practices is more useful than having the TLS spec. become
> obsolete soon after it's published.  BTW that draft suggests these
> cipher suites:
>
>     TLS_DHE_RSA_WITH_AES_128_GCM_SHA256
>     TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
>     TLS_DHE_RSA_WITH_AES_256_GCM_SHA384
>     TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
>
> Mike
>
> _______________________________________________
> TLS mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/tls
>

There are good reasons why not to use AES-GCM in software implementation
of TLS

https://www.imperialviolet.org/2012/10/21/nist.html
https://www.imperialviolet.org/2013/10/07/chacha20.html

Chacha20+Poly1305 is more efficient on CPUs without special instructions
to implement AES and GCM. Also secure implementation which doesn't leaks
timing information on such CPUs is easier.

Fedor