Subject: [TLS] Obscure ciphers in TLS 1.3

From: Dave Garrett <[email-masked]>
Date: Wed, 23 Sep 2015 18:41:06 -0400

https://tlswg.github.io/tls13-spec/#cipher-suites
https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-4

When I updated the lists in the TLS 1.3 draft, I just put everything in that is currently in the registry and usable. I'd like to now start a discussion on what should be allowed. Specifically, I have questions about ARIA and Camellia, as well as 8-bit authentication tag variants of AES-CCM or anything else.

How relevant is this ARIA attack?
https://eprint.iacr.org/2010/168

Are there any other known ARIA or Camellia issues?

Do either of these obscure ciphers actually get used enough to continue supporting in TLS 1.3+? (the AEAD versions, not the old suites that are no longer supported) If the answer is no, can we prohibit use of them in TLS 1.3+, or at least recommend against them?

Are the 8-bit authentication tag variants safe to recommend? If not, should we prohibit them completely, or at least recommend against them? If they are safe, should we add ones for AES-GCM?

Dave

---

From: Simon Josefsson <[email-masked]>
Date: Thu, 24 Sep 2015 01:35:43 +0200

Dave Garrett <[email-masked]> writes:

> Do either of these obscure ciphers actually get used enough to
> continue supporting in TLS 1.3+? (the AEAD versions, not the old
> suites that are no longer supported) If the answer is no, can we
> prohibit use of them in TLS 1.3+, or at least recommend against them?

Camellia appears to be used surprisingly often, at least I find several
occurances of it in my STARTTLS SMTP logs (one instance in my last
couple of days worth of logs is when talking to the email servers for
the tax authorities of Sweden...).

Still, I think its use is accidental and if we have AES+ChaCha20 and no
Camellia in TLS1.3 we are better off.

/Simon

---

From: "Salz, Rich" <[email-masked]>
Date: Wed, 23 Sep 2015 23:40:13 +0000

Do folks know that we did decide on the MTI list already, and that it's a matter of ekr updating the draft?  (It was decided at a PREVIOUS interim, it just fell through the cracks.)

And also, even if not, TLS 1.3 is only doing AEAD ciphers.

The registry isn't going to get purged, but all but two will not be allowed in 1.3.  Let's just wait on this thread a bit.

---

From: Dave Garrett <[email-masked]>
Date: Wed, 23 Sep 2015 20:23:20 -0400

> Do folks know that we did decide on the MTI list already, and that it's a matter of ekr updating the draft?  (It was decided at a PREVIOUS interim, it just fell through the cracks.)

The MTI list and the larger list of what can/should be supported at all are separate discussions.

> The registry isn't going to get purged, but all but two will not be allowed in 1.3.  Let's just wait on this thread a bit.

There are AEAD versions of ARIA and Camellia. These GCM suites are currently listed in the available Cipher Suites list in the draft.

Dave

---

From: "Scott Fluhrer (sfluhrer)" <[email-masked]>
Date: Thu, 24 Sep 2015 03:00:28 +0000

> -----Original Message-----
> From: TLS [mailto:[email-masked]] On Behalf Of Dave Garrett
> Sent: Wednesday, September 23, 2015 6:41 PM
> To: [email-masked]
> Subject: [TLS] Obscure ciphers in TLS 1.3
> 
> When I updated the lists in the TLS 1.3 draft, I just put everything in that is
> currently in the registry and usable. I'd like to now start a discussion on what
> should be allowed. Specifically, I have questions about ARIA and Camellia, as
> well as 8-bit authentication tag variants of AES-CCM or anything else.
> 

That's not relevant to the use of ARIA -- against 256 bit ARIA, it breaks 8 of 16 rounds; against 192 bit ARIA, it breaks 7 of 14 rounds.  That gives us a factor-of-2 safety margin for both key sizes, which is rather a lot.