Re: [TLS] draft-ietf-tls-psk-new-mac-aes-gcm-01 : portfolio question

[Peter Gutmann <pgut001 at cs.auckland.ac.nz>]

[It looks like outgoing mail from the last few days has been going missing,
 this is a resend.  Apologies in case it did get out and you've seen it
 before...]

Alfred H?nes <ah at tr-sys.de> writes:

>During off-list discussions of the changes for the -01 version of draft-ietf-
>tls-psk-new-mac-aes-gcm, it became apparent that there's a certain degree of
>imbalance in the draft regarding the portfolio of combinations of
>AES-{128|256}  with  SHA-{256|384} .

Why is -384 in there at all [0]?  It's a major pain to implement on non-64-bit
processors and just adds to code bloat on everything else.  Why not just stick
with a single unified SHA-256 until SHA-3 comes along in a year or two and
renders them obsolete?

Peter.

[0] Yes, I know the theoretical cryptographic arguments, but there's no sign
    of either -256 or -384 being stronger or weaker until they're displaced by
    SHA-3 anyway.


_______________________________________________
TLS mailing list
TLS at ietf.org
https://www.ietf.org/mailman/listinfo/tls