Subject: [TLS] Last Call: <draft-ietf-tls-ecdhe-psk-aead-03.txt> (ECDHE_PSK with AES-GCM and AES-CCM Cipher Suites for Transport Layer Security (TLS)) to Proposed Standard

From: The IESG <[email-masked]>
Date: Thu, 04 May 2017 09:41:05 -0700

The IESG has received a request from the Transport Layer Security WG
(tls) to consider the following document:
- 'ECDHE_PSK with AES-GCM and AES-CCM Cipher Suites for Transport Layer
   Security (TLS)'
  <draft-ietf-tls-ecdhe-psk-aead-03.txt> as Proposed Standard

The IESG plans to make a decision in the next few weeks, and solicits
final comments on this action. Please send substantive comments to the
[email-masked] mailing lists by 2017-05-18. Exceptionally, comments may be
sent to [email-masked] instead. In either case, please retain the
beginning of the Subject line to allow automated sorting.

Abstract

   This document defines several new cipher suites for the Transport
   Layer Security (TLS) protocol.  The cipher suites are all based on
   the Ephemeral Elliptic Curve Diffie-Hellman with Pre-Shared Key
   (ECDHE_PSK) key exchange together with the Authenticated Encryption
   with Associated Data (AEAD) algorithms AES-GCM and AES-CCM.  PSK
   provides light and efficient authentication, ECDHE provides perfect
   forward secrecy, and AES-GCM and AES-CCM provides encryption and
   integrity protection.

The file can be obtained via
https://datatracker.ietf.org/doc/draft-ietf-tls-ecdhe-psk-aead/

IESG discussion can be tracked via
https://datatracker.ietf.org/doc/draft-ietf-tls-ecdhe-psk-aead/ballot/

No IPR declarations have been submitted directly on this I-D.

---

From: Simon Friedberger <[email-masked]>
Date: Thu, 4 May 2017 23:58:47 +0200

Nits:

	RFC 4279 reference is missing.

	"TLS 1.3 and above version, " should probably be "TLS 1.3 and above" or "TLS 1.3 and higher versions"

On 04/05/17 18:41, The IESG wrote:
> _______________________________________________
> TLS mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/tls

---

From: Daniel Migault <[email-masked]>
Date: Thu, 18 May 2017 17:45:38 +0000

Hi Simon, 

Thank you for the review. I believe we have addressed your comments in our version 04. Please see my comments inline. 

Yours, 
Daniel

-----Original Message-----
From: TLS [mailto:[email-masked]] On Behalf Of Simon Friedberger
Sent: Thursday, May 04, 2017 5:59 PM
To: [email-masked]
Cc: [email-masked]
Subject: Re: [TLS] Last Call: <draft-ietf-tls-ecdhe-psk-aead-03.txt> (ECDHE_PSK with AES-GCM and AES-CCM Cipher Suites for Transport Layer Security (TLS)) to Proposed Standard

Nits:

	RFC 4279 reference is missing.
MGLT: It seems the reference is mentioned in the current version in the Normative reference as well  as in the introduction at line 127,  in section 3 line 143. In case you meant another reference, please let us know. 

	"TLS 1.3 and above version, " should probably be "TLS 1.3 and above" or "TLS 1.3 and higher versions"
MGLT: Changed to "TLS 1.3 and higher versions"

On 04/05/17 18:41, The IESG wrote:
> [email-masked] mailing lists by 2017-05-18. Exceptionally, comments may 
> be sent to [email-masked] instead. In either case, please retain the

---

From: Timothy Jackson <[email-masked]>
Date: Thu, 18 May 2017 20:52:04 +0000

One small nit.

> ECDHE provides perfect forward secrecy
I thought we had decided to change “perfect forward secrecy” to just “forward secrecy” since “perfect” is such a difficult standard to reach?

Tim
—
Tim Jackson | Product Security Architect | MobileIron, Inc.

On 5/18/17, 10:45 AM, "TLS on behalf of Daniel Migault" <[email-masked] on behalf of [email-masked]> wrote:

    Hi Simon, 

    Yours, 
    Daniel
    
    -----Original Message-----
    From: TLS [mailto:[email-masked]] On Behalf Of Simon Friedberger
    Sent: Thursday, May 04, 2017 5:59 PM
    To: [email-masked]
    Cc: [email-masked]
    Subject: Re: [TLS] Last Call: <draft-ietf-tls-ecdhe-psk-aead-03.txt> (ECDHE_PSK with AES-GCM and AES-CCM Cipher Suites for Transport Layer Security (TLS)) to Proposed Standard
    
    Nits:

---

From: "Blumenthal, Uri - 0553 - MITLL" <[email-masked]>
Date: Thu, 18 May 2017 21:01:02 +0000

It is a mathematical cryptographic term, and as such is incontrovertible. 

I say leave it in.

Regards,
Uri

Sent from my iPhone

> On May 18, 2017, at 16:58, Timothy Jackson <[email-masked]> wrote:
> 
> One small nit.
>

---

From: Daniel Migault <[email-masked]>
Date: Thu, 18 May 2017 17:17:19 -0400

Hi,

Thanks Tim and Uri for the comment. At least wikipedia considers them as
equivalent. I am fine either way, but leave it  as pfs unless there is a
consensus to change it to forward secrecy. If having fs seems important to
you please let us know asap!

Yours,
Daniel

On Thu, May 18, 2017 at 5:01 PM, Blumenthal, Uri - 0553 - MITLL <
[email-masked]> wrote:

> > I thought we had decided to change “perfect forward secrecy” to just
> “forward secrecy” since “perfect” is such a difficult standard to reach?
> >
> > Tim
> > —
> > On 5/18/17, 10:45 AM, "TLS on behalf of Daniel Migault" <
> [email-masked] on behalf of [email-masked]> wrote:
> >
> >    Hi Simon,
> >
> >    Thank you for the review. I believe we have addressed your comments
> in our version 04. Please see my comments inline.
> >
> >    Yours,
> >    Daniel
> >
> >    Subject: Re: [TLS] Last Call: <draft-ietf-tls-ecdhe-psk-aead-03.txt>
> (ECDHE_PSK with AES-GCM and AES-CCM Cipher Suites for Transport Layer
> Security (TLS)) to Proposed Standard
> >
> >    Nits:
> >
> >    MGLT: It seems the reference is mentioned in the current version in
> the Normative reference as well  as in the introduction at line 127,  in
> section 3 line 143. In case you meant another reference, please let us know.
> >
> >
> >

---

From: "Blumenthal, Uri - 0553 - MITLL" <[email-masked]>
Date: Thu, 18 May 2017 21:22:14 +0000

Instead of our in addition to the Wiki, check scholarly references. E.g., Introduction to Modern Cryptography, Handbook of Applied Cryptography, etc.

Regards,
Uri

Sent from my iPhone

> On May 18, 2017, at 17:18, Daniel Migault <[email-masked]> wrote:
> 
> Hi, 
> 
> Thanks Tim and Uri for the comment. At least wikipedia considers them as equivalent. I am fine either way, but leave it  as pfs unless there is a consensus to change it to forward secrecy. If having fs seems important to you please let us know asap!
> 
> Yours, 
> Daniel 
> 
>> On Thu, May 18, 2017 at 5:01 PM, Blumenthal, Uri - 0553 - MITLL <[email-masked]> wrote:

---

From: Eric Rescorla <[email-masked]>
Date: Thu, 18 May 2017 17:30:54 -0400

I don't much care, but we've moved to "forward secrecy" in TLS 1.3.

-Ekr

On Thu, May 18, 2017 at 5:17 PM, Daniel Migault <[email-masked]
> wrote:

---

From: Viktor Dukhovni <[email-masked]>
Date: Thu, 18 May 2017 17:51:07 -0400

> On May 18, 2017, at 5:30 PM, Eric Rescorla <[email-masked]> wrote:
> 

That's increasingly the more appropriate term.  Yes, historically
the word "perfect" was there too, but these days we understand that
it is only as perfect as the ephemeral key-agreement algorithm,
which is vulnerable to cryptanalytic advances.

-- 
	Viktor.

---

From: Daniel Migault <[email-masked]>
Date: Fri, 19 May 2017 08:57:22 -0400

Thanks for the feed backs. I have found two occurrences of perfect forward
secrecy which have been changed to forward secrecy.
Yours,
Daniel