17

It seems the only specified CTR mode ciphers in TLS are all GCM based.

GCM ciphers run AES-CTR and do authenticated encryption with a MAC based on Galois-field arithmetic ("GHASH") - and the latter seems to be difficult to get right in software (side-channel attacks, constant time) or require CPU hardware support (e.g. Intel AES-NI / PCLMULQDQ) which in turn might be manipulated/weakened via microcode updates/implants.

On the other hand HMAC-SHA256 seems relatively simple to do right in software and when used together with AES-CTR and a encrypt-then-MAC scheme.

So why are there no modes like TLS_DHE_RSA_AES128_SHA256?

The closest I could find is this unfinished, expired IETF draft.

oberstet
  • 447
  • 1
  • 5
  • 12

1 Answers1

16

Short answer:

There would be nothing (that isn't already wrong with TLS) necessarily wrong with a CTR + HMAC cipher suite, but the technical merits are only one factor in a technical feature getting to RFC status in the TLS working group.

Without being discourteous to the TLS Working Group (WG) participants or process, other reasons can be: political (including national/standards body alignment); personal/corporate preference/motivation; historical timing; resistance to change (modifying implementations is an often-cited cost); fear/uncertainty/doubt/apathy/debating skills etc. TLS standardization happens very much in a real world implementation + real humans interacting environment, where the isolated technical merits of an idea are by no means the only measure of, or contributing factor to, success.

Why the draft-ietf-tls-ctr in particular never made it to RFC status (as part of TLS 1.2 or separately) is a little murkier, but my best guess is that a combination of:

  • timing and politics: probably most importantly, AEAD modes such as GCM, many based on CTR mode, and in the case of GCM favoured by a NIST standardisation process, came along early in the TLS 1.2 process and probably supplanted CTR in the thinking of the WG editors/participants.
  • uncertainty: CTR in 2006 was relatively less known and trusted compared to CBC.
  • doubt: there were some concerns stated in the TLS WG discussions about its use in DTLS and with explicit vs implicit IVs
  • Eric Rescorla was both an author for draft-ietf-tls-ctr and co-editor of the TLS 1.2 draft, so I suspect once GCM became a preference for the WG he stopped editing and pushing the CTR mode.

Longer timeline:

  • Nov 2005

First mentions of draft-ietf-tls-ctr at Oct 2005 TLS WG meeting, at this stage not a chartered WG item.

  • Feb 2006

draft-ietf-tls-ctr 00 begins life as a companion draft to the TLS 1.2 draft 00.

  • March 2006

draft-ietf-tls-ctr is listed on the March 2006 TLS WG meeting agenda The TLS WG charter at that time explicitly discusses counter mode cipher suites as being a goal of TLS 1.2.

The March 2006 TLS WG meeting minutes refer to draft-ietf-tls-ctr as being a chartered item and ready for review.

At this point the First draft of TLS 1.2 specification, including CTR mode cipher suites milestone is marked as Done but CTR modes are clearly not in draft 1.2 specification at that time (or any other).

  • July 2006

At the July 2006 TLS WG meeting draft-ietf-tls-ctr is described as ready for last call in the minutes.

No last call for draft-ietf-tls-ctr eventuates on the TLS WG mailing list.

  • October 2006

TLS 1.2 draft 02 is published, and AEAD/GCM modes are included for the first time.

  • November 2006

At the Nov 2006 TLS WG meeting draft-ietf-tls-ctr is still on the agenda, and the minutes show discussion centered around the counter and IV structure. A GCM mode draft is mentioned as being imminent.

  • December 2006

Some concerns about counter mode, in particular counter/IV structures, are discussed on TLS WG mailing list.

  • January 2007

Discussion of CTR mode on the TLS WG mailing list has dried up apart from some discussion about potential issues with DTLS, and GCM mode is being actively discussed.

  • March 2007

draft-ietf-tls-ctr is still mentioned in the TLS 1.2 charter, but no longer on the March 2007 TLS WG meeting agenda, and all discussion in the minutes is about GCM.

From this point on draft-ietf-tls-ctr is not mentioned again, and no CTR modes end up in TLS 1.2. GCM modes go on to be published in RFC 5288 about the same time as TLS 1.2 is finalised in RFC 5246.

archie
  • 1,998
  • 17
  • 28