Addition of Camellia Cipher Suites to Transport Layer Security (TLS)
obsoleted by
- rfc-5932 — Camellia Cipher Suites for TLS
Extracted elements (13)
Camellia was chosen as an AES-compatible alternative because it supports the same 128-bit block size and 128/192/256-bit key sizes as AES, offering comparable speed in both software and hardware implementations. Its small hardware footprint makes it suitable for low-power embedded and smart card environments where AES may be less efficient.
Only 128-bit and 256-bit key sizes are defined in the cipher suites (192-bit is omitted), matching the subset defined for AES cipher suites in RFC 3268, on the grounds that these are 'efficient and practical enough for most uses, including high-security applications.'
The Camellia cipher suites are structurally parallel to the AES cipher suites defined in RFC 3268, using the same key exchange algorithms and MAC construction, enabling implementors familiar with AES-TLS to adopt Camellia with minimal changes.
All defined cipher suites use SHA-1 in an HMAC construction as specified in section 5 of RFC 2246 (TLS 1.0).
The cipher suites support six key exchange algorithms: RSA, DH_DSS, DH_RSA, DHE_DSS, DHE_RSA, and DH_anon, covering both authenticated and anonymous modes, consistent with the TLS 1.0 key exchange definitions in sections 7.4.2 and 7.4.3 of RFC 2246.
TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA ({0x00,0x46}) and TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA ({0x00,0x89}) provide anonymous (unauthenticated) Diffie-Hellman key exchange, offering no server authentication.
TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA is assigned code point {0x00,0x45} and TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA is assigned {0x00,0x88}, both providing forward secrecy via ephemeral Diffie-Hellman with RSA authentication.
TLS_RSA_WITH_CAMELLIA_128_CBC_SHA is assigned code point {0x00,0x41} and uses RSA key exchange with Camellia-128-CBC bulk encryption and SHA-1 HMAC.
Twelve new TLS cipher suites are defined using Camellia in CBC mode, split between 128-bit and 256-bit key variants. The 128-bit suites occupy code points 0x00,0x41–0x00,0x46 and the 256-bit suites occupy 0x00,0x84–0x00,0x89.
This document allocates twelve TLS cipher suite code points in the IANA TLS Cipher Suite Registry: 0x00,0x41–0x00,0x46 (Camellia-128-CBC suites) and 0x00,0x84–0x00,0x89 (Camellia-256-CBC suites).
Security properties not specific to Camellia (e.g., key exchange security, MAC security, protocol-level attacks) are inherited from TLS 1.0 (RFC 2246) and the AES-TLS cipher suites (RFC 3268); implementors are referred to those documents for further security considerations.
The Camellia cipher suites are not believed to be less secure than the corresponding AES-based cipher suites. Camellia has withstood extensive cryptanalysis in the CRYPTREC and EU NESSIE evaluation projects, and no weak keys are known at the time of publication.
CAMELLIA_128_CBC uses a 128-bit block cipher with 16 bytes of key material, 16-byte IV, and 16-byte block size. CAMELLIA_256_CBC uses 32 bytes of key material with the same IV and block size.