On Tue, Mar 15, 2016 at 05:37:20PM +0000, David Benjamin wrote: > On Mon, Mar 14, 2016 at 8:22 PM Eric Rescorla <e...@rtfm.com> wrote: > > > I would probably characterize it less as suites vs orthogonality, but as > wanting to keep divisions in meaningful and universal places and not > splitting up tightly-coupled decisions. The flexibility from orthogonality > can be handy, but going too far---as I believe TLS 1.2 did with signature, > prehash, and curve---complicates everything. Imagine if negotiating > AES_128_GCM required separately negotiating block cipher AES-128, mode CTR, > and MAC GHASH.
It isn't even orthogonal, it is coupled, which is way worse and quite difficult to implement correctly. I now consider the way TLS 1.3 draft / RFC4492bis draft currently does EdDSA negotiation a bad idea (what is proposed here is vast improvement). -Ilari _______________________________________________ TLS mailing list TLS@ietf.org https://www.ietf.org/mailman/listinfo/tls
