Subject: [rtcweb] Open Security issue: Crypto algorithms

From: Harald Alvestrand <[email-masked]>
Date: Wed, 06 May 2015 11:53:04 +0200

security-arch-11 contains the following text:

    All implementations MUST implement DTLS 1.0, with the cipher suite
    TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA and the DTLS-SRTP protection
    profile SRTP_AES128_CM_HMAC_SHA1_80.  Implementations SHOULD
    implement DTLS 1.2 with the TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
    cipher suite.  Implementations SHOULD favor cipher suites which
    support PFS over non-PFS cipher suites and GCM over CBC cipher
    suites.  [[OPEN ISSUE: Should we require ECDSA?  Waiting for WG
    Consensus.]]

security-arch-10 contained the following text in the same spot:

    All implementations MUST implement both DTLS 1.2 and DTLS 1.0, with
    the cipher suites TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 and
    TLS_DHE_RSA_WITH_AES_128_CBC_SHA and the DTLS-SRTP protection profile
    SRTP_AES128_CM_HMAC_SHA1_80.  Implementations SHOULD favor cipher
    suites which support PFS over non-PFS cipher suites and GCM over CBC
    cipher suites.  [[OPEN ISSUE:  Should we require ECDHE?  Waiting for
    TLS WG Consensus.]]

So it seems that consensus has shifted from MUST for DHE_RSA to MUST for 
ECDHE_RSA (presumably based on a TLS WG consensus), with some arguing 
for inclusion of ECDSA in the mandatory ciphersuites, and has landed on 
DTLS 1.0 only being mandatory.

I tried to find the discussion in the archives, but failed - which makes 
it hard to have an opionion of where consensus is heading; there is a 
February note from Martin that's relevant, but that's all I found.

Minutes from last meetings are here:

https://tools.ietf.org/wg/rtcweb/minutes?item=minutes-92-rtcweb.html
https://tools.ietf.org/wg/rtcweb/minutes?item=minutes-91-rtcweb.html

I couldn't find anything relevant there either.

Do we have an idea on how to move forward with resolving the outstanding 
question?

(the trigger for the question is a colleague looking into the crypto 
code for our implementation; he would prefer to spend his time making 
sure the stuff we specify as mandatory works well.)

Harald

---

From: Martin Thomson <[email-masked]>
Date: Wed, 6 May 2015 08:58:33 -0700

> Do we have an idea on how to move forward with resolving the outstanding

I would like to make ECDSA mandatory.  There seems to be no question
regarding ECDHE.  We intend to implement ECDSA, but need the
certificate management API additions so that we can avoid
compatibility issues (I'll note that chrome and firefox are perfectly
happy to negotiate ECDSA with anyone who chooses to use it today, but
there might be some gateway/server code out there that might not
tolerate it as readily).

We can ask TLS, but I will defer to the chairs on how they want to
collect feedback (one of the chairs is in a particularly good position
in this respect, I note).

---

From: Ted Hardie <[email-masked]>
Date: Thu, 7 May 2015 10:38:37 +0100

I am not chair with the particularly good position to collect feedback, but
I happen to know he's flying today.  My understanding of the current theory
is that we ask TLS what cipher suites and version numbers to mandate; if we
had a strong reason to disagree, we would need to document why we went with
something other than what they suggested.

He-who-is-in-the-air may tell me I've got it wrong, of course.

Ted

On Wed, May 6, 2015 at 4:58 PM, Martin Thomson <[email-masked]>
wrote:

> _______________________________________________
> rtcweb mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/rtcweb
>

---

From: Martin Thomson <[email-masked]>
Date: Thu, 7 May 2015 06:46:22 -0700

> He-who-is-in-the-air may tell me I've got it wrong, of course.

Sounds good, perhaps we should ask he-who-will-eventually-land to pass
on the question, unless we both are wrong.

---

From: Sean Turner <[email-masked]>
Date: Wed, 20 May 2015 08:56:24 -0400

> on the question, unless we both are wrong.

On it - albeit a little late. It’s worth noting that the UTA BCP195 (RFC 7525) (Recommendations for Secure Use of Transport Layer Security (TLS) and Datagram Transport Layer Security (DTLS)) was recently published and recommends this set of algorithms:

   o  TLS_DHE_RSA_WITH_AES_128_GCM_SHA256
   o  TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
   o  TLS_DHE_RSA_WITH_AES_256_GCM_SHA384
   o  TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

I also admit that I prefer ECDSA, primarily for smaller certs for comparable security, but acknowledge Martin’s point about the cert management APIs.

spt

---

From: Justin Uberti <[email-masked]>
Date: Thu, 21 May 2015 09:39:31 -0700

On Wed, May 20, 2015 at 5:56 AM, Sean Turner <[email-masked]> wrote:

> On it - albeit a little late. It’s worth noting that the UTA BCP195 (RFC
> 7525) (Recommendations for Secure Use of Transport Layer Security (TLS) and
> Datagram Transport Layer Security (DTLS)) was recently published and
> recommends this set of algorithms:
>
> I also admit that I prefer ECDSA, primarily for smaller certs for
> comparable security, but acknowledge Martin’s point about the cert
> management APIs.
>

I'd also like to see ECDSA mandated, since it is much more friendly for
low-power devices.

---

From: Martin Thomson <[email-masked]>
Date: Thu, 21 May 2015 10:03:55 -0700

On 21 May 2015 at 09:39, Justin Uberti <[email-masked]> wrote:
>> TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256

This would be my preference for a MUST.

---

From: "Cullen Jennings (fluffy)" <[email-masked]>
Date: Tue, 26 May 2015 20:33:20 +0000

> On May 21, 2015, at 11:03 AM, Martin Thomson <[email-masked]> wrote:
> 

I looked into the the issue with backwards compat with gateways / servers. It seems that most the stuff I could find claimed Suite B compliance or was based on recent version of openssl - either way, I'm not seeing a problem with making 
TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 MTI. 

I agree it has advantage for low power stuff. I think the IoT people that want to use the WebRTC data channel would be much happier with no RSA (or to put it a bit more concretely, I doubt they will put both EC and RSA on very small stuff regardless of what our specs require and they seem to be mostly going EC not RSA).

---

From: Martin Thomson <[email-masked]>
Date: Tue, 26 May 2015 14:40:30 -0700

On 26 May 2015 at 13:33, Cullen Jennings (fluffy) <[email-masked]> wrote:
> I'm not seeing a problem with making

Thanks for doing the checking.  If we can agree on this, then I'd be
quite happy.

p.s., Everyone is welcome to contact me privately if you want a
Firefox build that does ECDSA only if you want to test for
compatibility with your software.