[TLS] Synopsis of CFRG discussions on new stream ciphers and MACs for TLS

"Igoe, Kevin M." <kmigoe@nsa.gov> Wed, 09 October 2013 16:50 UTC

From: "Igoe, Kevin M." <kmigoe@nsa.gov>
To: "'tls@ietf.org'" <tls@ietf.org>
Thread-Topic: Synopsis of CFRG discussions on new stream ciphers and MACs for TLS
Thread-Index: Ac7FD7VT2T4r3M83SauM1r3DE/e5ww==
Date: Wed, 09 Oct 2013 16:50:49 +0000
Message-ID: <3C4AAD4B5304AB44A6BA85173B4675CAB24E246F@MSMR-GH1-UEA03.corp.nsa.gov>
Accept-Language: en-US
Content-Language: en-US
Content-Type: multipart/alternative; boundary="_000_3C4AAD4B5304AB44A6BA85173B4675CAB24E246FMSMRGH1UEA03cor_"
MIME-Version: 1.0
Subject: [TLS] Synopsis of CFRG discussions on new stream ciphers and MACs for TLS
Precedence: list

As requested by the TLS WG during IETF-87, the CFRG discussed the
suitability of the candidate stream ciphers and MACs proposed for
use in TLS.

Three stream ciphers have been discussed:
        * The original SALSA-20
        * ChaCha, a variant of SALSA-20, modifying the prolog and
        epilog to increase efficiency.
        * eStream SALSA-20 (hereafter eSALSA) reduces the number
        of rounds from 20 rounds in SALSA-20 down to 12 rounds in
        eSalsa.

The  discussion of these stream ciphers boiled down to the
following points:
        * There seems to be substantial controversy over the
        efficiency of the various stream cipher candidates,
        especially when compared to AES counter modes.  This
        needs to be straightened out before an informed decision
        can be made.
On the maturity of the cryptanalysis of the three stream ciphers:
        * The analysis of SALSA-20 has been very thorough and the
        degree of confidence in SALSA-20 is very high.
        * Though ChaCha has received slightly less analysis, the
        CFRG is confident that the analysis was sufficiently
        thorough that ChaCha is an acceptable alternative to
        SALSA-20.
        * The RG was less comfortable with the maturity of the
        analysis of eSALSA, but no substantive objections were
        raised.
Cryptanalytically all three are almost certainly sufficient for
use in TLS.  The RG expressed a preference for ChaCha.

We were also asked our opinion on the MACs being considered, UMAC
and POLY1305. No cryptanalytic issues were raised, though VMAC was
suggested as a more efficient alternative to UMAC. The
suitability of these MACs for efficient hardware implementation
was questioned.


----------------+--------------------------------------------------
Kevin M. Igoe   | "We can't solve problems by using the same kind
kmigoe@nsa.gov  | of thinking we used when we created them."
                |              - Albert Einstein -
----------------+--------------------------------------------------

[TLS] Synopsis of CFRG discussions on new stream … Igoe, Kevin M.
Re: [TLS] Synopsis of CFRG discussions on new str… Blumenthal, Uri - 0558 - MITLL