--- /dev/null
+TLS Working Group Mohamad Badra
+Internet Draft LIMOS Laboratory
+Intended status: Standards Track April 30, 2008
+Expires: October 2008
+
+
+
+ Pre-Shared Key Cipher Suites for Transport Layer Security (TLS) with
+ SHA-256/384 and AES Galois Counter Mode
+ draft-badra-tls-psk-new-mac-aes-gcm-02.txt
+
+
+Status of this Memo
+
+ By submitting this Internet-Draft, each author represents that any
+ applicable patent or other IPR claims of which he or she is aware
+ have been or will be disclosed, and any of which he or she becomes
+ aware will be disclosed, in accordance with Section 6 of BCP 79.
+
+ Internet-Drafts are working documents of the Internet Engineering
+ Task Force (IETF), its areas, and its working groups. Note that
+ other groups may also distribute working documents as Internet-
+ Drafts.
+
+ Internet-Drafts are draft documents valid for a maximum of six
+ months and may be updated, replaced, or obsoleted by other documents
+ at any time. It is inappropriate to use Internet-Drafts as
+ reference material or to cite them other than as "work in progress."
+
+ The list of current Internet-Drafts can be accessed at
+ http://www.ietf.org/ietf/1id-abstracts.txt
+
+ The list of Internet-Draft Shadow Directories can be accessed at
+ http://www.ietf.org/shadow.html
+
+ This Internet-Draft will expire on October 30, 2008.
+
+Copyright Notice
+
+ Copyright (C) The IETF Trust (2008).
+
+Abstract
+
+ RFC 4279 and RFC 4785 describe pre-shared key cipher suites for
+ Transport Layer Security (TLS). However, all those cipher suites
+ use SHA-1 as their MAC algorithm. This document describes a set of
+ cipher suites for TLS/DTLS which uses stronger digest algorithms
+
+
+
+
+Badra Expires October 30, 2008 [Page 1]
+\f
+Internet-Draft TLS PSK New MAC and AES-GCM April 2008
+
+
+ (i.e., SHA-256 or SHA-384) and another which uses the Advanced
+ Encryption Standard (AES) in Galois Counter Mode (GCM).
+
+Table of Contents
+
+
+ 1. Introduction...................................................3
+ 1.1. Conventions used in this document.........................3
+ 2. PSK, DHE_PSK and RSA_PSK Key Exchange Algorithms with AES-GCM..3
+ 3. PSK, DHE_PSK and RSA_PSK Key Exchange with SHA-256/384.........4
+ 3.1. PSK Key Exchange Algorithm with SHA-256/384...............4
+ 3.2. DHE_PSK Key Exchange Algorithm with SHA-256/384...........5
+ 3.3. RSA_PSK Key Exchange Algorithm with SHA-256/384...........5
+ 4. Security Considerations........................................5
+ 5. IANA Considerations............................................6
+ 6. Acknowledgments................................................6
+ 7. References.....................................................6
+ 7.1. Normative References......................................6
+ 7.2. Informative References....................................7
+ Author's Addresses................................................8
+ Full Copyright Statement..........................................8
+ Intellectual Property.............................................8
+ Acknowledgment....................................................9
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+Badra Expires October 30, 2008 [Page 2]
+\f
+Internet-Draft TLS PSK New MAC and AES-GCM April 2008
+
+
+1. Introduction
+
+ TLS 1.2 [I-D.ietf-tls-rfc4346-bis], adds support for authenticated
+ encryption with additional data (AEAD) cipher modes [RFC5116]. This
+ document describes the use of Advanced Encryption Standard (AES)
+ [AES] in Galois Counter Mode (GCM) [GCM] (AES-GCM) with various pre-
+ shared key (PSK) key exchange mechanisms ([RFC4279] and [RFC4785])
+ as a cipher suite for Transport Layer Security (TLS).
+
+ This document also specifies PSK cipher suites for TLS which replace
+ SHA-1 by SHA-256 or SHA-384. RFC 4279 [RFC4279] and RFC 4785
+ [RFC4785] describe PSK cipher suites for TLS. However, all of the
+ RFC 4279 and the RFC 4785 cipher suites use HMAC-SHA1 as their MAC
+ algorithm. Due to recent analytic work on SHA-1 [Wang05], the IETF
+ is gradually moving away from SHA-1 and towards stronger hash
+ algorithms.
+
+ ECC based cipher suites with SHA-256/384 and AES-GCM are defined in
+ [I-D.ietf-tls-ecc-new-mac]; RSA, DSS and Diffie-Hellman based cipher
+ suites are specified in [I-D.ietf-tls-rsa-aes-gcm]. The reader is
+ expected to become familiar with these two memos prior to studying
+ this document.
+
+1.1. Conventions used in this document
+
+ The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
+ "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
+ document are to be interpreted as described in [RFC2119].
+
+2. PSK, DHE_PSK and RSA_PSK Key Exchange Algorithms with AES-GCM
+
+ The following eight cipher suites use the new authenticated
+ encryption modes defined in TLS 1.2 with AES in Galois Counter Mode
+ (GCM) [GCM]. The cipher suites with DHE_PSK key exchange algorithm
+ (TLS_DHE_PSK_WITH_AES_128_GCM_SHA256 and
+ TLS_DHE_PSK_WITH_AES_128_GCM_SHA348) provide Perfect Forward Secrecy
+ (PFS).
+
+ CipherSuite TLS_PSK_WITH_AES_128_GCM_SHA256 = {0xXX,0xXX};
+ CipherSuite TLS_PSK_WITH_AES_258_GCM_SHA256 = {0xXX,0xXX};
+ CipherSuite TLS_PSK_WITH_AES_128_GCM_SHA384 = {0xXX,0xXX};
+ CipherSuite TLS_PSK_WITH_AES_256_GCM_SHA384 = {0xXX,0xXX};
+ CipherSuite TLS_DHE_PSK_WITH_AES_128_GCM_SHA256 = {0xXX,0xXX};
+ CipherSuite TLS_DHE_PSK_WITH_AES_256_GCM_SHA384 = {0xXX,0xXX};
+ CipherSuite TLS_RSA_PSK_WITH_AES_128_GCM_SHA256 = {0xXX,0xXX};
+ CipherSuite TLS_RSA_PSK_WITH_AES_256_GCM_SHA384 = {0xXX,0xXX};
+
+
+
+Badra Expires October 30, 2008 [Page 3]
+\f
+Internet-Draft TLS PSK New MAC and AES-GCM April 2008
+
+
+ These cipher suites use authenticated encryption with additional
+ data (AEAD) algorithms AEAD_AES_128_GCM and AEAD_AES_256_GCM
+ described in RFC 5116. GCM is used as described in [I-D.ietf-tls-
+ rsa-aes-gcm].
+
+ The PSK, DHE_PSK and RSA_PSK key exchanges are performed as defined
+ in [RFC4279].
+
+ The PRF algorithms SHALL be as follows:
+
+ For cipher suites ending with _SHA256, the PRF is the TLS PRF
+ [I-D.ietf-tls-rfc4346-bis] with SHA-256 as the hash function.
+
+ For cipher suites ending with _SHA384, the PRF is the TLS PRF
+ [I-D.ietf-tls-rfc4346-bis] with SHA-384 as the hash function.
+
+ Implementations MUST send TLS Alert bad_record_mac for all types of
+ failures encountered in processing the AES-GCM algorithm.
+
+3. PSK, DHE_PSK and RSA_PSK Key Exchange with SHA-256/384
+
+ The cipher suites described in this section use AES [AES] in CBC
+ [CBC] mode with an HMAC-based MAC.
+
+3.1. PSK Key Exchange Algorithm with SHA-256/384
+
+ CipherSuite TLS_PSK_WITH_AES_128_CBC_SHA256 = {0xXX,0xXX};
+ CipherSuite TLS_PSK_WITH_AES_256_CBC_SHA256 = {0xXX,0xXX};
+ CipherSuite TLS_PSK_WITH_AES_128_CBC_SHA384 = {0xXX,0xXX};
+ CipherSuite TLS_PSK_WITH_AES_256_CBC_SHA384 = {0xXX,0xXX};
+ CipherSuite TLS_PSK_WITH_NULL_SHA256 = {0xXX,0xXX};
+ CipherSuite TLS_PSK_WITH_NULL_SHA384 = {0xXX,0xXX};
+
+ The above six cipher suites are the same as the corresponding cipher
+ suites in RFC 4279 and RFC 4785 (with names ending in "_SHA" in
+ place of "_SHA256" or "_SHA384"), except for the hash and PRF
+ algorithms, which are SHA-256 and SHA-384 [SHS] as follows.
+
+ CipherSuite MAC PRF
+ ------------ --- ---
+ TLS_PSK_WITH_AES_128_CBC_SHA256 HMAC-SHA-256 P_SHA-256
+ TLS_PSK_WITH_AES_128_CBC_SHA384 HMAC-SHA-384 P_SHA-384
+ TLS_PSK_WITH_AES_256_CBC_SHA256 HMAC-SHA-256 P_SHA-256
+ TLS_PSK_WITH_AES_256_CBC_SHA384 HMAC-SHA-384 P_SHA-384
+ TLS_PSK_WITH_NULL_SHA256 HMAC-SHA-256 P_SHA-256
+ TLS_PSK_WITH_NULL_SHA384 HMAC-SHA-384 P_SHA-384
+
+
+
+Badra Expires October 30, 2008 [Page 4]
+\f
+Internet-Draft TLS PSK New MAC and AES-GCM April 2008
+
+
+3.2. DHE_PSK Key Exchange Algorithm with SHA-256/384
+
+ CipherSuite TLS_DHE_PSK_WITH_AES_128_CBC_SHA256 = {0xXX,0xXX};
+ CipherSuite TLS_DHE_PSK_WITH_AES_128_CBC_SHA384 = {0xXX,0xXX};
+ CipherSuite TLS_DHE_PSK_WITH_AES_256_CBC_SHA256 = {0xXX,0xXX};
+ CipherSuite TLS_DHE_PSK_WITH_AES_256_CBC_SHA384 = {0xXX,0xXX};
+ CipherSuite TLS_DHE_PSK_WITH_NULL_SHA256 = {0xXX,0xXX};
+ CipherSuite TLS_DHE_PSK_WITH_NULL_SHA384 = {0xXX,0xXX};
+
+ The above six cipher suites are the same as the corresponding cipher
+ suites in RFC 4279 and RFC 4785 (with names ending in "_SHA" in
+ place of "_SHA256" or "_SHA384"), except for the hash and PRF
+ algorithms, which are SHA-256 and SHA-384 [SHS] as follows.
+
+ CipherSuite MAC PRF
+ ------------ --- ---
+ TLS_DHE_PSK_WITH_AES_128_CBC_SHA256 HMAC-SHA-256 P_SHA-256
+ TLS_DHE_PSK_WITH_AES_128_CBC_SHA384 HMAC-SHA-384 P_SHA-384
+ TLS_DHE_PSK_WITH_AES_256_CBC_SHA256 HMAC-SHA-256 P_SHA-256
+ TLS_DHE_PSK_WITH_AES_256_CBC_SHA384 HMAC-SHA-384 P_SHA-384
+
+3.3. RSA_PSK Key Exchange Algorithm with SHA-256/384
+
+ CipherSuite TLS_RSA_PSK_WITH_AES_128_CBC_SHA256 = {0xXX,0xXX};
+ CipherSuite TLS_RSA_PSK_WITH_AES_128_CBC_SHA384 = {0xXX,0xXX};
+ CipherSuite TLS_RSA_PSK_WITH_AES_256_CBC_SHA256 = {0xXX,0xXX};
+ CipherSuite TLS_RSA_PSK_WITH_AES_256_CBC_SHA384 = {0xXX,0xXX};
+
+ The above four cipher suites are the same as the corresponding
+ cipher suites in RFC 4279 and RFC 4785 (with names ending in "_SHA"
+ in place of "_SHA256" or "_SHA384"), except for the hash and PRF
+ algorithms, which are SHA-256 and SHA-384 [SHS] as follows.
+
+ CipherSuite MAC PRF
+ ------------ --- ---
+ TLS_RSA_PSK_WITH_AES_128_CBC_SHA256 HMAC-SHA-256 P_SHA-256
+ TLS_RSA_PSK_WITH_AES_128_CBC_SHA384 HMAC-SHA-384 P_SHA-384
+ TLS_RSA_PSK_WITH_AES_256_CBC_SHA256 HMAC-SHA-256 P_SHA-256
+ TLS_RSA_PSK_WITH_AES_256_CBC_SHA384 HMAC-SHA-384 P_SHA-384
+
+4. Security Considerations
+
+ The security considerations in RFC 4279, RFC 4758, and [I-D.ietf-
+ tls-rsa-aes-gcm] apply to this document as well. In addition, as
+ described in [I-D.ietf-tls-rsa-aes-gcm], these cipher suites may
+ only be used with TLS 1.2 or greater.
+
+
+
+Badra Expires October 30, 2008 [Page 5]
+\f
+Internet-Draft TLS PSK New MAC and AES-GCM April 2008
+
+
+5. IANA Considerations
+
+ IANA has assigned the following values for the cipher suites defined
+ in this document:
+
+ CipherSuite TLS_PSK_WITH_AES_128_GCM_SHA256 = {0xXX,0xXX};
+ CipherSuite TLS_PSK_WITH_AES_258_GCM_SHA256 = {0xXX,0xXX};
+ CipherSuite TLS_PSK_WITH_AES_128_GCM_SHA384 = {0xXX,0xXX};
+ CipherSuite TLS_PSK_WITH_AES_256_GCM_SHA384 = {0xXX,0xXX};
+ CipherSuite TLS_DHE_PSK_WITH_AES_128_GCM_SHA256 = {0xXX,0xXX};
+ CipherSuite TLS_DHE_PSK_WITH_AES_256_GCM_SHA384 = {0xXX,0xXX};
+ CipherSuite TLS_RSA_PSK_WITH_AES_128_GCM_SHA256 = {0xXX,0xXX};
+ CipherSuite TLS_RSA_PSK_WITH_AES_256_GCM_SHA384 = {0xXX,0xXX};
+ CipherSuite TLS_PSK_WITH_AES_128_CBC_SHA256 = {0xXX,0xXX};
+ CipherSuite TLS_PSK_WITH_AES_256_CBC_SHA256 = {0xXX,0xXX};
+ CipherSuite TLS_PSK_WITH_AES_128_CBC_SHA384 = {0xXX,0xXX};
+ CipherSuite TLS_PSK_WITH_AES_256_CBC_SHA384 = {0xXX,0xXX};
+ CipherSuite TLS_PSK_WITH_NULL_SHA256 = {0xXX,0xXX};
+ CipherSuite TLS_PSK_WITH_NULL_SHA384 = {0xXX,0xXX};
+ CipherSuite TLS_DHE_PSK_WITH_AES_128_CBC_SHA256 = {0xXX,0xXX};
+ CipherSuite TLS_DHE_PSK_WITH_AES_128_CBC_SHA384 = {0xXX,0xXX};
+ CipherSuite TLS_DHE_PSK_WITH_AES_256_CBC_SHA256 = {0xXX,0xXX};
+ CipherSuite TLS_DHE_PSK_WITH_AES_256_CBC_SHA384 = {0xXX,0xXX};
+ CipherSuite TLS_DHE_PSK_WITH_NULL_SHA256 = {0xXX,0xXX};
+ CipherSuite TLS_DHE_PSK_WITH_NULL_SHA384 = {0xXX,0xXX};
+ CipherSuite TLS_RSA_PSK_WITH_AES_128_CBC_SHA256 = {0xXX,0xXX};
+ CipherSuite TLS_RSA_PSK_WITH_AES_128_CBC_SHA384 = {0xXX,0xXX};
+ CipherSuite TLS_RSA_PSK_WITH_AES_256_CBC_SHA256 = {0xXX,0xXX};
+ CipherSuite TLS_RSA_PSK_WITH_AES_256_CBC_SHA384 = {0xXX,0xXX};
+
+6. Acknowledgments
+
+ This draft borrows heavily from [I-D.ietf-tls-ecc-new-mac] and [I-
+ D.ietf-tls-rsa-aes-gcm].
+
+7. References
+
+7.1. Normative References
+
+ [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
+ Requirement Levels", BCP 14, RFC 2119, March 1997.
+
+ [I-D.ietf-tls-rfc4346-bis]
+ Dierks, T. and E. Rescorla, "The Transport Layer Security
+ (TLS) Protocol Version 1.2", draft-ietf-tls-rfc4346-bis-
+ 10, work in progress, March 2008.
+
+
+
+Badra Expires October 30, 2008 [Page 6]
+\f
+Internet-Draft TLS PSK New MAC and AES-GCM April 2008
+
+
+ [RFC5116] McGrew, D., "An Interface and Algorithms for Authenticated
+ Encryption", RFC 5116, January 2008.
+
+ [RFC4279] Eronen, P. and H. Tschofenig, "Pre-Shared Key Ciphersuites
+ for Transport Layer Security (TLS)", RFC 4279, December
+ 2005.
+
+ [RFC4785] Blumenthal, U., Goel, P., "Pre-Shared Key (PSK)
+ Ciphersuites with NULL Encryption for Transport Layer
+ Security (TLS)", RFC 4785, January 2007.
+
+ [AES] National Institute of Standards and Technology,
+ "Specification for the Advanced Encryption Standard
+ (AES)", FIPS 197, November 2001.
+
+ [SHS] National Institute of Standards and Technology, "Secure
+ Hash Standard", FIPS 180-2, August 2002.
+
+ [CBC] National Institute of Standards and Technology,
+ "Recommendation for Block Cipher Modes of Operation -
+ Methods and Techniques", SP 800-38A, December 2001.
+
+ [GCM] National Institute of Standards and Technology,
+ "Recommendation for Block Cipher Modes of Operation:
+ Galois;/Counter Mode (GCM) for Confidentiality and
+ Authentication", SP 800-38D, November 2007.
+
+7.2. Informative References
+
+ [Wang05] Wang, X., Yin, Y., and H. Yu, "Finding Collisions in the
+ Full SHA-1", CRYPTO 2005, August 2005.
+
+ [I-D.ietf-tls-ecc-new-mac]
+ Rescorla, E., "TLS Elliptic Curve Cipher Suites with SHA-
+ 256/384 and AES Galois Counter Mode", draft-ietf-tls-ecc-
+ new-mac-06 (work in progress), April 2008.
+
+ [I-D.ietf-tls-rsa-aes-gcm]
+ Salowey, J., A. Choudhury, and C. McGrew, "RSA based AES-
+ GCM Cipher Suites for TLS", draft-ietf-tls-rsa-aes-gcm-03
+ (work in progress), April 2008.
+
+
+
+
+
+
+
+
+Badra Expires October 30, 2008 [Page 7]
+\f
+Internet-Draft TLS PSK New MAC and AES-GCM April 2008
+
+
+Author's Addresses
+
+ Mohamad Badra
+ LIMOS Laboratory - UMR6158, CNRS
+ France
+
+ Email: badra@isima.fr
+
+
+Full Copyright Statement
+
+ Copyright (C) The IETF Trust (2008).
+
+ This document is subject to the rights, licenses and restrictions
+ contained in BCP 78, and except as set forth therein, the authors
+ retain all their rights.
+
+ This document and the information contained herein are provided on
+ an "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE
+ REPRESENTS OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY, THE
+ IETF TRUST AND THE INTERNET ENGINEERING TASK FORCE DISCLAIM ALL
+ WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY
+ WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE
+ ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS
+ FOR A PARTICULAR PURPOSE.
+
+Intellectual Property
+
+ The IETF takes no position regarding the validity or scope of any
+ Intellectual Property Rights or other rights that might be claimed
+ to pertain to the implementation or use of the technology described
+ in this document or the extent to which any license under such
+ rights might or might not be available; nor does it represent that
+ it has made any independent effort to identify any such rights.
+ Information on the procedures with respect to rights in RFC
+ documents can be found in BCP 78 and BCP 79.
+
+ Copies of IPR disclosures made to the IETF Secretariat and any
+ assurances of licenses to be made available, or the result of an
+ attempt made to obtain a general license or permission for the use
+ of such proprietary rights by implementers or users of this
+ specification can be obtained from the IETF on-line IPR repository
+ at http://www.ietf.org/ipr.
+
+ The IETF invites any interested party to bring to its attention any
+ copyrights, patents or patent applications, or other proprietary
+ rights that may cover technology that may be required to implement
+
+
+Badra Expires October 30, 2008 [Page 8]
+\f
+Internet-Draft TLS PSK New MAC and AES-GCM April 2008
+
+
+ this standard. Please address the information to the IETF at ietf-
+ ipr@ietf.org.
+
+Acknowledgment
+
+ Funding for the RFC Editor function is provided by the IETF
+ Administrative Support Activity (IASA).
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+Badra Expires October 30, 2008 [Page 9]
+\f
projects / thirdparty / gnutls.git / commitdiff
