Missing Algorithms / Cipher Suites

[pinkforest]

TBD - Just putting this up and working up what peeps may want

Assuming upstreamed impl:

• https://github.com/stevefan1999-personal/rustls-provider-rustcrypto/blob/master/src/lib.rs#L37C2-L44C51

RFC/IANA

• TLS 1.3 Mandatory - RFC 8446 s. 9.1 at https://www.rfc-editor.org/rfc/rfc8446#page-102
• IANA TLS Parameters: https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml
• Recommendations for TLS at https://datatracker.ietf.org/doc/html/rfc7525

Configurations

• Mozilla: https://wiki.mozilla.org/Security/Server_Side_TLS#Cipher_names_correspondence_table

TLS 1.3 - Cipher Suites

Cipher Suite	RFC	Implemented
TLS_AES_128_GCM_SHA256	Must	✔️
TLS_AES_256_GCM_SHA384	Should	✔️
TLS_AES_128_CCM_SHA256	Should	❌
TLS_CHACHA20_POLY1305_SHA256	Should	✔️
AEGIS ..	-	?

TLS 1.3 - Algorithms

Algorithm	RFC	Scope	Implemented	Which Impl
rsa_pkcs1_sha256	Must	certificates	✔️
rsa_pss_rsae_sha256	Must	CertificateVerify and certificates	✔️
ecdsa_secp256r1_sha256	Must	CertificateVerify and certificates	✔️
secp256r1 (NIST P-256)	Must	Key Exchange	✔️
X25519 (RFC7748)	Should	Key Exchange	✔️
X448 (RFC8418)	draft	Key Exchange	❌

TLS 1.2 - Cipher Suites

Cipher Suite	RFC	Implemented	Which Impl
TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256		✔️
TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA25		✔️
TLS_DHE_RSA_WITH_AES_128_GCM_SHA256	Recommended	🤔
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256	Recommended	🤔
TLS_DHE_RSA_WITH_AES_256_GCM_SHA384	Recommended	🤔
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384	Recommended	🤔

Browser Support

• TLS1.3 https://caniuse.com/tls1-3

Stats

• https://blog.apnic.net/2022/08/17/tls-1-3-a-story-of-experimentation-and-centralization/

[tarcieri]

Re: TLS_DHE_* ciphersuites, we don't currently have an implementation of FFDH(E). I'm also not super enthusiastic about adding such support as it's effectively been obsoleted by the TLS_ECDHE_* ciphersuites.

[newpavlov]

It would be nice to add the GOST cipher suite described in the RFC 9367, though we currently do not have implementation of the GOST curves (it should be relatively easy to add them based on the primeorder crate).

[ctz]

It would be nice to add the GOST cipher suite

But... why? It's not widely deployed, and not really meaningfully better than the widely deployed alternatives (though admittedly I am not up to date on the literature there).

[newpavlov]

It's the same story as with FIPS, in some cases you don't have choice but to use it (and BTW I do dislike the MGM mode with its 127-bit nonces and lack of misuse resistance despite using two block cipher invocations per block). If someone is interested in implementing other regional standards, I think we should include them as well. Attracting such captive audience could be quite useful for additional security audits of the whole stack, since they often have to pass through a rigorous certification process.

[pinkforest]

Does anyone remember know / what happened at IETF with OCB getting it to TLS 1.3 ?

Like after draft-zauner-tls-aes-ocb-04
Or https://mailarchive.ietf.org/arch/msg/tls/qZiGzQiePuURYTZrd3bHUFKrtD4/

I'm keen getting AEGIS supported given CAESAR entry and some draft activity in IETF + implementations picking up

• https://eprint.iacr.org/2013/695.pdf
• https://datatracker.ietf.org/doc/draft-irtf-cfrg-aegis-aead/
• https://github.com/jedisct1/draft-denis-tls-aegis

Frank wrote Portable C libaegis and Zig AEGIS-..-X which ended into Zig std and picotls has implementation and BoringSSL has experimental etc. etc.

[tarcieri]

I've recently asked about it. It's possible work might resume.

[pinkforest]

When doing #66 it reminded OpenSSL has Goldilocks / curve448 supported group - since 2018 and FIPS 186-5 / RFC8418

[tarcieri]

There was some discussion of upstreaming an Ed448 implementation here: RustCrypto/elliptic-curves#114 (comment)

[pinkforest]

Frank has brought in Rust AEGIS here: https://github.com/jedisct1/rust-aegis

Would love to compose these things universaly via cfg's coming together at the rustls using binary - so raised issue:

• pure-rust via cfg("aegis_backend" = "..") vs cfg(feature = "..") jedisct1/rust-aegis#5

Inspired by that - raised which begs overall configuration for CryptoProvider bringing it all together for the binary:

• Consistent composure of backend overrides #79