Subject: [rtcweb] draft-ietf-rtcweb-security-arch and crypto agility

From: Cullen Jennings <[email-masked]>
Date: Wed, 31 Aug 2016 11:51:08 -0600

The security arch only requires one cipher TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA with the the P-256 curve. Only having one seems like a bad idea of a crypto agility point of view. Lets say it turns out there is a problem with that curve or with EC in general, deployments will not have anything they can switch to. 

I'd like to keep one of the RSA based ciphers as also MTI.

---

From: Eric Rescorla <[email-masked]>
Date: Wed, 31 Aug 2016 13:15:38 -0700

On Wed, Aug 31, 2016 at 10:51 AM, Cullen Jennings <[email-masked]> wrote:

> The security arch only requires one cipher TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
> with the the P-256 curve. Only having one seems like a bad idea of a crypto
> agility point of view. Lets say it turns out there is a problem with that
> curve or with EC in general, deployments will not have anything they can
> switch to.
>

Having just one MTI cipher suite is pretty much SOP (this is what TLS 1.2
does, for instance).
I wouldn't be opposed to requiring another group, presumably either X25519
or FFDH2048.
(Yes, I am aware that these are at opposite ends of the spectrum).

The RSA ciphers do not provide PFS, so I do not think this is a good plan

-Ekr

---

From: Cullen Jennings <[email-masked]>
Date: Wed, 31 Aug 2016 16:52:21 -0600

> On Aug 31, 2016, at 2:15 PM, Eric Rescorla <[email-masked]> wrote:
> 
> Having just one MTI cipher suite is pretty much SOP (this is what TLS 1.2 does, for instance).
> I wouldn't be opposed to requiring another group, presumably either X25519 or FFDH2048.

I was assuming some sort of DH combined with RSA. I do know we want to stick with PFS schemes.