rfc-5289

TLS Elliptic Curve Cipher Suites with SHA-256/384 and AES Galois Counter Mode (GCM)

E. Rescorla

date2008-08 streamIETF areasec wgtls statusPROPOSED STANDARD pages6 canonicalhttps://www.rfc-editor.org/rfc/rfc5289 doi10.17487/RFC5289

RFC 4492 describes elliptic curve cipher suites for Transport Layer Security (TLS). However, all those cipher suites use HMAC-SHA-1 as their Message Authentication Code (MAC) algorithm. This document describes sixteen new cipher suites for TLS that specify stronger MAC algorithms. Eight use Hashed Message Authentication Code (HMAC) with SHA-256 or SHA-384, and eight use AES in Galois Counter Mode (GCM). This memo provides information for the Internet community.

Extracted elements (11)

design-rationale §1

This document was motivated by analytic weaknesses found in SHA-1 (Wang et al., CRYPTO 2005), prompting the IETF to move away from SHA-1 toward stronger hash algorithms such as SHA-256 and SHA-384 for TLS ECC cipher suites.

tls, crypto, security

interoperability-note §3.1

The eight HMAC-based cipher suites are identical to the corresponding RFC 4492 cipher suites (with names ending in '_SHA') except for the MAC and PRF algorithms; they use SHA-256 or SHA-384 instead of SHA-1.

tls, crypto

interoperability-note §3.2

The GCM cipher suites use AEAD_AES_128_GCM and AEAD_AES_256_GCM as defined in RFC 5116, and GCM operation follows RFC 5288; these suites require TLS 1.2 or later.

tls, crypto

normative-requirement §3.1 REQUIRED

For cipher suites ending with _SHA256, the PRF SHALL be the TLS PRF with SHA-256 as the hash function, and the MAC SHALL be HMAC with SHA-256.

tls, crypto

normative-requirement §3.1 REQUIRED

For cipher suites ending with _SHA384, the PRF SHALL be the TLS PRF with SHA-384 as the hash function, and the MAC SHALL be HMAC with SHA-384.

tls, crypto

normative-requirement §3.2 REQUIRED

For GCM cipher suites ending with _SHA256, the PRF SHALL be the TLS PRF with SHA-256; for those ending with _SHA384, the PRF SHALL use SHA-384. GCM is used as described in RFC 5288.

tls, crypto

protocol-element §3.2

Eight GCM-based cipher suites use AES in Galois Counter Mode: TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 {0xC0,0x2B}, TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 {0xC0,0x2C}, TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256 {0xC0,0x2D}, TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384 {0xC0,0x2E}, TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 {0xC0,0x2F}, TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 {0xC0,0x30}, TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256 {0xC0,0x31}, TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384 {0xC0,0x32}.

tls, crypto

protocol-element §3.1

Eight HMAC-based cipher suites use AES in CBC mode: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 {0xC0,0x23}, TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 {0xC0,0x24}, TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256 {0xC0,0x25}, TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384 {0xC0,0x26}, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 {0xC0,0x27}, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 {0xC0,0x28}, TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256 {0xC0,0x29}, TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384 {0xC0,0x2A}.

tls, crypto

protocol-element §3

Sixteen new TLS cipher suites are defined using Elliptic Curve Cryptography for key exchange and digital signature. Eight use AES-CBC with HMAC-SHA-256 or HMAC-SHA-384, and eight use AES-GCM with SHA-256 or SHA-384 as the PRF hash.

tls, crypto

registry §5

IANA assigned 16 new TLS cipher suite codepoints ranging from {0xC0,0x23} through {0xC0,0x32} for the ECC cipher suites with SHA-256/384 and AES-CBC/GCM defined in this document.

tls, registry

security-consideration §4

These cipher suites may only be used with TLS 1.2 or greater, as referenced from RFC 5288. The security considerations in RFC 4346, RFC 4492, and RFC 5288 all apply.

tls, security