diff options
Diffstat (limited to 'doc/protocol/draft-badra-tls-psk-new-mac-aes-gcm-02.txt')
| -rw-r--r-- | doc/protocol/draft-badra-tls-psk-new-mac-aes-gcm-02.txt | 485 |
1 files changed, 485 insertions, 0 deletions
diff --git a/doc/protocol/draft-badra-tls-psk-new-mac-aes-gcm-02.txt b/doc/protocol/draft-badra-tls-psk-new-mac-aes-gcm-02.txt new file mode 100644 index 0000000000..91d2cb8ea4 --- /dev/null +++ b/doc/protocol/draft-badra-tls-psk-new-mac-aes-gcm-02.txt @@ -0,0 +1,485 @@ +TLS Working Group Mohamad Badra +Internet Draft LIMOS Laboratory +Intended status: Standards Track April 30, 2008 +Expires: October 2008 + + + + Pre-Shared Key Cipher Suites for Transport Layer Security (TLS) with + SHA-256/384 and AES Galois Counter Mode + draft-badra-tls-psk-new-mac-aes-gcm-02.txt + + +Status of this Memo + + By submitting this Internet-Draft, each author represents that any + applicable patent or other IPR claims of which he or she is aware + have been or will be disclosed, and any of which he or she becomes + aware will be disclosed, in accordance with Section 6 of BCP 79. + + Internet-Drafts are working documents of the Internet Engineering + Task Force (IETF), its areas, and its working groups. Note that + other groups may also distribute working documents as Internet- + Drafts. + + Internet-Drafts are draft documents valid for a maximum of six + months and may be updated, replaced, or obsoleted by other documents + at any time. It is inappropriate to use Internet-Drafts as + reference material or to cite them other than as "work in progress." + + The list of current Internet-Drafts can be accessed at + http://www.ietf.org/ietf/1id-abstracts.txt + + The list of Internet-Draft Shadow Directories can be accessed at + http://www.ietf.org/shadow.html + + This Internet-Draft will expire on October 30, 2008. + +Copyright Notice + + Copyright (C) The IETF Trust (2008). + +Abstract + + RFC 4279 and RFC 4785 describe pre-shared key cipher suites for + Transport Layer Security (TLS). However, all those cipher suites + use SHA-1 as their MAC algorithm. This document describes a set of + cipher suites for TLS/DTLS which uses stronger digest algorithms + + + + +Badra Expires October 30, 2008 [Page 1] + +Internet-Draft TLS PSK New MAC and AES-GCM April 2008 + + + (i.e., SHA-256 or SHA-384) and another which uses the Advanced + Encryption Standard (AES) in Galois Counter Mode (GCM). + +Table of Contents + + + 1. Introduction...................................................3 + 1.1. Conventions used in this document.........................3 + 2. PSK, DHE_PSK and RSA_PSK Key Exchange Algorithms with AES-GCM..3 + 3. PSK, DHE_PSK and RSA_PSK Key Exchange with SHA-256/384.........4 + 3.1. PSK Key Exchange Algorithm with SHA-256/384...............4 + 3.2. DHE_PSK Key Exchange Algorithm with SHA-256/384...........5 + 3.3. RSA_PSK Key Exchange Algorithm with SHA-256/384...........5 + 4. Security Considerations........................................5 + 5. IANA Considerations............................................6 + 6. Acknowledgments................................................6 + 7. References.....................................................6 + 7.1. Normative References......................................6 + 7.2. Informative References....................................7 + Author's Addresses................................................8 + Full Copyright Statement..........................................8 + Intellectual Property.............................................8 + Acknowledgment....................................................9 + + + + + + + + + + + + + + + + + + + + + + + + + + +Badra Expires October 30, 2008 [Page 2] + +Internet-Draft TLS PSK New MAC and AES-GCM April 2008 + + +1. Introduction + + TLS 1.2 [I-D.ietf-tls-rfc4346-bis], adds support for authenticated + encryption with additional data (AEAD) cipher modes [RFC5116]. This + document describes the use of Advanced Encryption Standard (AES) + [AES] in Galois Counter Mode (GCM) [GCM] (AES-GCM) with various pre- + shared key (PSK) key exchange mechanisms ([RFC4279] and [RFC4785]) + as a cipher suite for Transport Layer Security (TLS). + + This document also specifies PSK cipher suites for TLS which replace + SHA-1 by SHA-256 or SHA-384. RFC 4279 [RFC4279] and RFC 4785 + [RFC4785] describe PSK cipher suites for TLS. However, all of the + RFC 4279 and the RFC 4785 cipher suites use HMAC-SHA1 as their MAC + algorithm. Due to recent analytic work on SHA-1 [Wang05], the IETF + is gradually moving away from SHA-1 and towards stronger hash + algorithms. + + ECC based cipher suites with SHA-256/384 and AES-GCM are defined in + [I-D.ietf-tls-ecc-new-mac]; RSA, DSS and Diffie-Hellman based cipher + suites are specified in [I-D.ietf-tls-rsa-aes-gcm]. The reader is + expected to become familiar with these two memos prior to studying + this document. + +1.1. Conventions used in this document + + The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", + "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this + document are to be interpreted as described in [RFC2119]. + +2. PSK, DHE_PSK and RSA_PSK Key Exchange Algorithms with AES-GCM + + The following eight cipher suites use the new authenticated + encryption modes defined in TLS 1.2 with AES in Galois Counter Mode + (GCM) [GCM]. The cipher suites with DHE_PSK key exchange algorithm + (TLS_DHE_PSK_WITH_AES_128_GCM_SHA256 and + TLS_DHE_PSK_WITH_AES_128_GCM_SHA348) provide Perfect Forward Secrecy + (PFS). + + CipherSuite TLS_PSK_WITH_AES_128_GCM_SHA256 = {0xXX,0xXX}; + CipherSuite TLS_PSK_WITH_AES_258_GCM_SHA256 = {0xXX,0xXX}; + CipherSuite TLS_PSK_WITH_AES_128_GCM_SHA384 = {0xXX,0xXX}; + CipherSuite TLS_PSK_WITH_AES_256_GCM_SHA384 = {0xXX,0xXX}; + CipherSuite TLS_DHE_PSK_WITH_AES_128_GCM_SHA256 = {0xXX,0xXX}; + CipherSuite TLS_DHE_PSK_WITH_AES_256_GCM_SHA384 = {0xXX,0xXX}; + CipherSuite TLS_RSA_PSK_WITH_AES_128_GCM_SHA256 = {0xXX,0xXX}; + CipherSuite TLS_RSA_PSK_WITH_AES_256_GCM_SHA384 = {0xXX,0xXX}; + + + +Badra Expires October 30, 2008 [Page 3] + +Internet-Draft TLS PSK New MAC and AES-GCM April 2008 + + + These cipher suites use authenticated encryption with additional + data (AEAD) algorithms AEAD_AES_128_GCM and AEAD_AES_256_GCM + described in RFC 5116. GCM is used as described in [I-D.ietf-tls- + rsa-aes-gcm]. + + The PSK, DHE_PSK and RSA_PSK key exchanges are performed as defined + in [RFC4279]. + + The PRF algorithms SHALL be as follows: + + For cipher suites ending with _SHA256, the PRF is the TLS PRF + [I-D.ietf-tls-rfc4346-bis] with SHA-256 as the hash function. + + For cipher suites ending with _SHA384, the PRF is the TLS PRF + [I-D.ietf-tls-rfc4346-bis] with SHA-384 as the hash function. + + Implementations MUST send TLS Alert bad_record_mac for all types of + failures encountered in processing the AES-GCM algorithm. + +3. PSK, DHE_PSK and RSA_PSK Key Exchange with SHA-256/384 + + The cipher suites described in this section use AES [AES] in CBC + [CBC] mode with an HMAC-based MAC. + +3.1. PSK Key Exchange Algorithm with SHA-256/384 + + CipherSuite TLS_PSK_WITH_AES_128_CBC_SHA256 = {0xXX,0xXX}; + CipherSuite TLS_PSK_WITH_AES_256_CBC_SHA256 = {0xXX,0xXX}; + CipherSuite TLS_PSK_WITH_AES_128_CBC_SHA384 = {0xXX,0xXX}; + CipherSuite TLS_PSK_WITH_AES_256_CBC_SHA384 = {0xXX,0xXX}; + CipherSuite TLS_PSK_WITH_NULL_SHA256 = {0xXX,0xXX}; + CipherSuite TLS_PSK_WITH_NULL_SHA384 = {0xXX,0xXX}; + + The above six cipher suites are the same as the corresponding cipher + suites in RFC 4279 and RFC 4785 (with names ending in "_SHA" in + place of "_SHA256" or "_SHA384"), except for the hash and PRF + algorithms, which are SHA-256 and SHA-384 [SHS] as follows. + + CipherSuite MAC PRF + ------------ --- --- + TLS_PSK_WITH_AES_128_CBC_SHA256 HMAC-SHA-256 P_SHA-256 + TLS_PSK_WITH_AES_128_CBC_SHA384 HMAC-SHA-384 P_SHA-384 + TLS_PSK_WITH_AES_256_CBC_SHA256 HMAC-SHA-256 P_SHA-256 + TLS_PSK_WITH_AES_256_CBC_SHA384 HMAC-SHA-384 P_SHA-384 + TLS_PSK_WITH_NULL_SHA256 HMAC-SHA-256 P_SHA-256 + TLS_PSK_WITH_NULL_SHA384 HMAC-SHA-384 P_SHA-384 + + + +Badra Expires October 30, 2008 [Page 4] + +Internet-Draft TLS PSK New MAC and AES-GCM April 2008 + + +3.2. DHE_PSK Key Exchange Algorithm with SHA-256/384 + + CipherSuite TLS_DHE_PSK_WITH_AES_128_CBC_SHA256 = {0xXX,0xXX}; + CipherSuite TLS_DHE_PSK_WITH_AES_128_CBC_SHA384 = {0xXX,0xXX}; + CipherSuite TLS_DHE_PSK_WITH_AES_256_CBC_SHA256 = {0xXX,0xXX}; + CipherSuite TLS_DHE_PSK_WITH_AES_256_CBC_SHA384 = {0xXX,0xXX}; + CipherSuite TLS_DHE_PSK_WITH_NULL_SHA256 = {0xXX,0xXX}; + CipherSuite TLS_DHE_PSK_WITH_NULL_SHA384 = {0xXX,0xXX}; + + The above six cipher suites are the same as the corresponding cipher + suites in RFC 4279 and RFC 4785 (with names ending in "_SHA" in + place of "_SHA256" or "_SHA384"), except for the hash and PRF + algorithms, which are SHA-256 and SHA-384 [SHS] as follows. + + CipherSuite MAC PRF + ------------ --- --- + TLS_DHE_PSK_WITH_AES_128_CBC_SHA256 HMAC-SHA-256 P_SHA-256 + TLS_DHE_PSK_WITH_AES_128_CBC_SHA384 HMAC-SHA-384 P_SHA-384 + TLS_DHE_PSK_WITH_AES_256_CBC_SHA256 HMAC-SHA-256 P_SHA-256 + TLS_DHE_PSK_WITH_AES_256_CBC_SHA384 HMAC-SHA-384 P_SHA-384 + +3.3. RSA_PSK Key Exchange Algorithm with SHA-256/384 + + CipherSuite TLS_RSA_PSK_WITH_AES_128_CBC_SHA256 = {0xXX,0xXX}; + CipherSuite TLS_RSA_PSK_WITH_AES_128_CBC_SHA384 = {0xXX,0xXX}; + CipherSuite TLS_RSA_PSK_WITH_AES_256_CBC_SHA256 = {0xXX,0xXX}; + CipherSuite TLS_RSA_PSK_WITH_AES_256_CBC_SHA384 = {0xXX,0xXX}; + + The above four cipher suites are the same as the corresponding + cipher suites in RFC 4279 and RFC 4785 (with names ending in "_SHA" + in place of "_SHA256" or "_SHA384"), except for the hash and PRF + algorithms, which are SHA-256 and SHA-384 [SHS] as follows. + + CipherSuite MAC PRF + ------------ --- --- + TLS_RSA_PSK_WITH_AES_128_CBC_SHA256 HMAC-SHA-256 P_SHA-256 + TLS_RSA_PSK_WITH_AES_128_CBC_SHA384 HMAC-SHA-384 P_SHA-384 + TLS_RSA_PSK_WITH_AES_256_CBC_SHA256 HMAC-SHA-256 P_SHA-256 + TLS_RSA_PSK_WITH_AES_256_CBC_SHA384 HMAC-SHA-384 P_SHA-384 + +4. Security Considerations + + The security considerations in RFC 4279, RFC 4758, and [I-D.ietf- + tls-rsa-aes-gcm] apply to this document as well. In addition, as + described in [I-D.ietf-tls-rsa-aes-gcm], these cipher suites may + only be used with TLS 1.2 or greater. + + + +Badra Expires October 30, 2008 [Page 5] + +Internet-Draft TLS PSK New MAC and AES-GCM April 2008 + + +5. IANA Considerations + + IANA has assigned the following values for the cipher suites defined + in this document: + + CipherSuite TLS_PSK_WITH_AES_128_GCM_SHA256 = {0xXX,0xXX}; + CipherSuite TLS_PSK_WITH_AES_258_GCM_SHA256 = {0xXX,0xXX}; + CipherSuite TLS_PSK_WITH_AES_128_GCM_SHA384 = {0xXX,0xXX}; + CipherSuite TLS_PSK_WITH_AES_256_GCM_SHA384 = {0xXX,0xXX}; + CipherSuite TLS_DHE_PSK_WITH_AES_128_GCM_SHA256 = {0xXX,0xXX}; + CipherSuite TLS_DHE_PSK_WITH_AES_256_GCM_SHA384 = {0xXX,0xXX}; + CipherSuite TLS_RSA_PSK_WITH_AES_128_GCM_SHA256 = {0xXX,0xXX}; + CipherSuite TLS_RSA_PSK_WITH_AES_256_GCM_SHA384 = {0xXX,0xXX}; + CipherSuite TLS_PSK_WITH_AES_128_CBC_SHA256 = {0xXX,0xXX}; + CipherSuite TLS_PSK_WITH_AES_256_CBC_SHA256 = {0xXX,0xXX}; + CipherSuite TLS_PSK_WITH_AES_128_CBC_SHA384 = {0xXX,0xXX}; + CipherSuite TLS_PSK_WITH_AES_256_CBC_SHA384 = {0xXX,0xXX}; + CipherSuite TLS_PSK_WITH_NULL_SHA256 = {0xXX,0xXX}; + CipherSuite TLS_PSK_WITH_NULL_SHA384 = {0xXX,0xXX}; + CipherSuite TLS_DHE_PSK_WITH_AES_128_CBC_SHA256 = {0xXX,0xXX}; + CipherSuite TLS_DHE_PSK_WITH_AES_128_CBC_SHA384 = {0xXX,0xXX}; + CipherSuite TLS_DHE_PSK_WITH_AES_256_CBC_SHA256 = {0xXX,0xXX}; + CipherSuite TLS_DHE_PSK_WITH_AES_256_CBC_SHA384 = {0xXX,0xXX}; + CipherSuite TLS_DHE_PSK_WITH_NULL_SHA256 = {0xXX,0xXX}; + CipherSuite TLS_DHE_PSK_WITH_NULL_SHA384 = {0xXX,0xXX}; + CipherSuite TLS_RSA_PSK_WITH_AES_128_CBC_SHA256 = {0xXX,0xXX}; + CipherSuite TLS_RSA_PSK_WITH_AES_128_CBC_SHA384 = {0xXX,0xXX}; + CipherSuite TLS_RSA_PSK_WITH_AES_256_CBC_SHA256 = {0xXX,0xXX}; + CipherSuite TLS_RSA_PSK_WITH_AES_256_CBC_SHA384 = {0xXX,0xXX}; + +6. Acknowledgments + + This draft borrows heavily from [I-D.ietf-tls-ecc-new-mac] and [I- + D.ietf-tls-rsa-aes-gcm]. + +7. References + +7.1. Normative References + + [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate + Requirement Levels", BCP 14, RFC 2119, March 1997. + + [I-D.ietf-tls-rfc4346-bis] + Dierks, T. and E. Rescorla, "The Transport Layer Security + (TLS) Protocol Version 1.2", draft-ietf-tls-rfc4346-bis- + 10, work in progress, March 2008. + + + +Badra Expires October 30, 2008 [Page 6] + +Internet-Draft TLS PSK New MAC and AES-GCM April 2008 + + + [RFC5116] McGrew, D., "An Interface and Algorithms for Authenticated + Encryption", RFC 5116, January 2008. + + [RFC4279] Eronen, P. and H. Tschofenig, "Pre-Shared Key Ciphersuites + for Transport Layer Security (TLS)", RFC 4279, December + 2005. + + [RFC4785] Blumenthal, U., Goel, P., "Pre-Shared Key (PSK) + Ciphersuites with NULL Encryption for Transport Layer + Security (TLS)", RFC 4785, January 2007. + + [AES] National Institute of Standards and Technology, + "Specification for the Advanced Encryption Standard + (AES)", FIPS 197, November 2001. + + [SHS] National Institute of Standards and Technology, "Secure + Hash Standard", FIPS 180-2, August 2002. + + [CBC] National Institute of Standards and Technology, + "Recommendation for Block Cipher Modes of Operation - + Methods and Techniques", SP 800-38A, December 2001. + + [GCM] National Institute of Standards and Technology, + "Recommendation for Block Cipher Modes of Operation: + Galois;/Counter Mode (GCM) for Confidentiality and + Authentication", SP 800-38D, November 2007. + +7.2. Informative References + + [Wang05] Wang, X., Yin, Y., and H. Yu, "Finding Collisions in the + Full SHA-1", CRYPTO 2005, August 2005. + + [I-D.ietf-tls-ecc-new-mac] + Rescorla, E., "TLS Elliptic Curve Cipher Suites with SHA- + 256/384 and AES Galois Counter Mode", draft-ietf-tls-ecc- + new-mac-06 (work in progress), April 2008. + + [I-D.ietf-tls-rsa-aes-gcm] + Salowey, J., A. Choudhury, and C. McGrew, "RSA based AES- + GCM Cipher Suites for TLS", draft-ietf-tls-rsa-aes-gcm-03 + (work in progress), April 2008. + + + + + + + + +Badra Expires October 30, 2008 [Page 7] + +Internet-Draft TLS PSK New MAC and AES-GCM April 2008 + + +Author's Addresses + + Mohamad Badra + LIMOS Laboratory - UMR6158, CNRS + France + + Email: badra@isima.fr + + +Full Copyright Statement + + Copyright (C) The IETF Trust (2008). + + This document is subject to the rights, licenses and restrictions + contained in BCP 78, and except as set forth therein, the authors + retain all their rights. + + This document and the information contained herein are provided on + an "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE + REPRESENTS OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY, THE + IETF TRUST AND THE INTERNET ENGINEERING TASK FORCE DISCLAIM ALL + WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY + WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE + ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS + FOR A PARTICULAR PURPOSE. + +Intellectual Property + + The IETF takes no position regarding the validity or scope of any + Intellectual Property Rights or other rights that might be claimed + to pertain to the implementation or use of the technology described + in this document or the extent to which any license under such + rights might or might not be available; nor does it represent that + it has made any independent effort to identify any such rights. + Information on the procedures with respect to rights in RFC + documents can be found in BCP 78 and BCP 79. + + Copies of IPR disclosures made to the IETF Secretariat and any + assurances of licenses to be made available, or the result of an + attempt made to obtain a general license or permission for the use + of such proprietary rights by implementers or users of this + specification can be obtained from the IETF on-line IPR repository + at http://www.ietf.org/ipr. + + The IETF invites any interested party to bring to its attention any + copyrights, patents or patent applications, or other proprietary + rights that may cover technology that may be required to implement + + +Badra Expires October 30, 2008 [Page 8] + +Internet-Draft TLS PSK New MAC and AES-GCM April 2008 + + + this standard. Please address the information to the IETF at ietf- + ipr@ietf.org. + +Acknowledgment + + Funding for the RFC Editor function is provided by the IETF + Administrative Support Activity (IASA). + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +Badra Expires October 30, 2008 [Page 9] + |