-
Notifications
You must be signed in to change notification settings - Fork 7
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Missing Algorithms / Cipher Suites #1
Comments
Re: |
It would be nice to add the GOST cipher suite described in the RFC 9367, though we currently do not have implementation of the GOST curves (it should be relatively easy to add them based on the |
But... why? It's not widely deployed, and not really meaningfully better than the widely deployed alternatives (though admittedly I am not up to date on the literature there). |
It's the same story as with FIPS, in some cases you don't have choice but to use it (and BTW I do dislike the MGM mode with its 127-bit nonces and lack of misuse resistance despite using two block cipher invocations per block). If someone is interested in implementing other regional standards, I think we should include them as well. Attracting such captive audience could be quite useful for additional security audits of the whole stack, since they often have to pass through a rigorous certification process. |
Does anyone remember know / what happened at IETF with OCB getting it to TLS 1.3 ? Like after draft-zauner-tls-aes-ocb-04 I'm keen getting AEGIS supported given CAESAR entry and some draft activity in IETF + implementations picking up
Frank wrote Portable C libaegis and Zig AEGIS-..-X which ended into Zig std and picotls has implementation and BoringSSL has experimental etc. etc. |
I've recently asked about it. It's possible work might resume. |
When doing #66 it reminded OpenSSL has Goldilocks / curve448 supported group - since 2018 and FIPS 186-5 / RFC8418 |
There was some discussion of upstreaming an Ed448 implementation here: RustCrypto/elliptic-curves#114 (comment) |
Frank has brought in Rust AEGIS here: https://github.com/jedisct1/rust-aegis Would love to compose these things universaly via cfg's coming together at the rustls using binary - so raised issue: Inspired by that - raised which begs overall configuration for CryptoProvider bringing it all together for the binary: |
TBD - Just putting this up and working up what peeps may want
Assuming upstreamed impl:
RFC/IANA
Configurations
TLS 1.3 - Cipher Suites
TLS 1.3 - Algorithms
TLS 1.2 - Cipher Suites
Browser Support
Stats
The text was updated successfully, but these errors were encountered: