rfc-5487

Pre-Shared Key Cipher Suites for TLS with SHA-256/384 and AES Galois Counter Mode

M. Badra

date2009-03 streamIETF areasec wgtls statusPROPOSED STANDARD pages7 canonicalhttps://www.rfc-editor.org/rfc/rfc5487 doi10.17487/RFC5487

RFC 4279 and RFC 4785 describe pre-shared key cipher suites for Transport Layer Security (TLS). However, all those cipher suites use SHA-1 in their Message Authentication Code (MAC) algorithm. This document describes a set of pre-shared key cipher suites for TLS that uses stronger digest algorithms (i.e., SHA-256 or SHA-384) and another set that uses the Advanced Encryption Standard (AES) in Galois Counter Mode (GCM). [STANDARDS-TRACK]

Extracted elements (13)

design-rationale §1

All RFC 4279 and RFC 4785 PSK cipher suites use HMAC-SHA1 as their MAC algorithm. Due to recent analytic work on SHA-1 (Wang et al., CRYPTO 2005), the IETF is gradually moving away from SHA-1 and towards stronger hash algorithms, motivating the new suites defined here.

tls, crypto, security

design-rationale §2

The DHE_PSK key exchange variants (TLS_DHE_PSK_WITH_AES_128_GCM_SHA256 and TLS_DHE_PSK_WITH_AES_256_GCM_SHA384) were included specifically because they provide Perfect Forward Secrecy (PFS), unlike the plain PSK and RSA_PSK variants.

tls, crypto, security

interoperability-note §3.1

The SHA-256/384 cipher suites in Section 3 are identical to corresponding RFC 4279 and RFC 4785 cipher suites (with names ending in '_SHA') except for the hash and PRF algorithms. Implementers upgrading from RFC 4279/4785 need only update the MAC and PRF selection logic.

tls, security

normative-requirement §2 REQUIRED

For AES-GCM cipher suites, the PRF SHALL be the TLS PRF (RFC 5246) with SHA-256 for suites ending in _SHA256, and with SHA-384 for suites ending in _SHA384.

tls, crypto

normative-requirement §3.1 MUST

For SHA-256/384 CBC cipher suites negotiated in TLS prior to version 1.2, the PRF from that version is used; when negotiated in TLS 1.2 or higher, the TLS PRF (RFC 5246) with SHA-256 or SHA-384 (matching the suite name) is used.

tls, crypto

normative-requirement §2 MUST

Implementations MUST send a TLS Alert 'bad_record_mac' for all types of failures encountered in processing the AES-GCM algorithm.

tls, security

normative-requirement §1.1 MUST

The AES-GCM cipher suites defined in Section 2 can only be negotiated in TLS version 1.2 or higher. The SHA-256/384 CBC cipher suites defined in Section 3 can be negotiated in any negotiated TLS version.

tls, security

protocol-element §3.2

Four DHE_PSK CBC cipher suites with stronger MACs are defined: TLS_DHE_PSK_WITH_AES_128_CBC_SHA256 (0x00,0xB2), TLS_DHE_PSK_WITH_AES_256_CBC_SHA384 (0x00,0xB3), TLS_DHE_PSK_WITH_NULL_SHA256 (0x00,0xB4), and TLS_DHE_PSK_WITH_NULL_SHA384 (0x00,0xB5). These mirror RFC 4279 DHE_PSK suites but use SHA-256 or SHA-384 for HMAC and PRF.

tls, crypto, security

protocol-element §3.1

Four PSK CBC cipher suites with stronger MACs are defined: TLS_PSK_WITH_AES_128_CBC_SHA256 (0x00,0xAE), TLS_PSK_WITH_AES_256_CBC_SHA384 (0x00,0xAF), TLS_PSK_WITH_NULL_SHA256 (0x00,0xB0), and TLS_PSK_WITH_NULL_SHA384 (0x00,0xB1). These replace the HMAC-SHA1 MAC from RFC 4279/4785 with HMAC-SHA256 or HMAC-SHA384.

tls, crypto, security

protocol-element §3.3

Four RSA_PSK CBC cipher suites with stronger MACs are defined: TLS_RSA_PSK_WITH_AES_128_CBC_SHA256 (0x00,0xB6), TLS_RSA_PSK_WITH_AES_256_CBC_SHA384 (0x00,0xB7), TLS_RSA_PSK_WITH_NULL_SHA256 (0x00,0xB8), and TLS_RSA_PSK_WITH_NULL_SHA384 (0x00,0xB9). These mirror RFC 4279 RSA_PSK suites but use SHA-256 or SHA-384 for HMAC and PRF.

tls, crypto, security

protocol-element §2

Six PSK AES-GCM cipher suites are defined for TLS 1.2+: TLS_PSK_WITH_AES_128_GCM_SHA256 (0x00,0xA8), TLS_PSK_WITH_AES_256_GCM_SHA384 (0x00,0xA9), TLS_DHE_PSK_WITH_AES_128_GCM_SHA256 (0x00,0xAA), TLS_DHE_PSK_WITH_AES_256_GCM_SHA384 (0x00,0xAB), TLS_RSA_PSK_WITH_AES_128_GCM_SHA256 (0x00,0xAC), and TLS_RSA_PSK_WITH_AES_256_GCM_SHA384 (0x00,0xAD). These use AEAD_AES_128_GCM and AEAD_AES_256_GCM as defined in RFC 5116.

tls, crypto, security

registry §5

IANA assigned 18 new TLS cipher suite code points in the range {0x00,0xA8} through {0x00,0xB9} for the PSK AES-GCM and PSK SHA-256/384 cipher suites defined in this document.

tls, registry, security

security-consideration §4

Authentication-only cipher suites with NULL encryption (TLS_PSK_WITH_NULL_SHA256, TLS_PSK_WITH_NULL_SHA384, etc.) do not support confidentiality. Care should be taken not to send sensitive information such as passwords over connections protected with these NULL-encryption cipher suites.

tls, security