Re: [TLS] WGLC for rsa-aes-gcm and ecc-new-mac

[Simon Josefsson <simon at josefsson.org>]

<Pasi.Eronen at nokia.com> writes:

> <wg chair hat on>
>
> This message starts a WG last call on the following two drafts:
>
>   draft-ietf-tls-rsa-aes-gcm-02
>   draft-ietf-tls-ecc-new-mac-04
>
> prior to sending them to the IESG for publication as Proposed 
> Standard (rsa-aes-gcm) and Informational (ecc-new-mac).
>
> Please send your comments to the WG mailing list by Wednesday 
> March 5th. Comments along the lines "I've read it and it looks 
> OK" are helpful and encouraged.

With the following fixes, I think the documents are OK.  I haven't
implemented them though, so there may be still be other issues.

For draft-ietf-tls-ecc-new-mac-04:

* Section 1 says "This document specifies TLS ECC cipher suites which
  replace SHA-256 and SHA-384 rather than SHA-1.".  I can't parse this.
  s/replace/uses/?

* Section 2.1 and 2.2, where is P_SHA-256 defined etc?  RFC 4346bis
  mentions P_SHA256 but not P_SHA-256.

* Section 2.2, what should be done if AES-GCM decrypt fails?  Unlike
  most others ciphers, AES-GCM can fail to decrypt data.  Either a
  discussion, or a pointer to discussion elsewhere, to specify the
  behaviour in TLS would be useful.  There may be side-channel
  considerations here, so it may be relevant to add that decrypt errors
  should not be leaked.

For draft-ietf-tls-rsa-aes-gcm-02:

* Section 1, typo "ciphersutes".

* Section 3, same as for the other document, what should be done if
  AES-GCM decrypt fails?

/Simon
_______________________________________________
TLS mailing list
TLS at ietf.org
http://www.ietf.org/mailman/listinfo/tls