[TLS] RE: SIV as WG item?

[<Pasi.Eronen at nokia.com>]

Simon Josefsson wrote:

> Generally speaking, I believe the crypto community will produce
> several AEAD cipher modes with rather different properties (speed,
> IV-use, provable security, patent status, and so on).
> 
> Having all those ciphers defined for TLS is an advantage, to allow
> interoperable testing.  What is less clear at this point is which of
> the alternatives to prefer.

Many of the arguments made in the recent discussion about IDEA
(e.g., more code means more complexity and less security in
practise, especially if some of that code is rarely used and thus
largely untested; and having too many "vanity" options just causes
problems) would suggest that having *all* those ciphers defined in
TLS would not be a such good idea.

This doesn't mean that we have to decide on a single AEAD mode, but
IMHO for any specs we write, we should have an expectation that it
will see non-insignificant real-world deployment (i.e., ends up
being used, as opposed to just being implemented by some library).

Best regards,
Pasi


_______________________________________________
TLS mailing list
TLS at lists.ietf.org
https://www1.ietf.org/mailman/listinfo/tls