Camellia Cipher Suites for TLS
obsoletes
- rfc-4132 — Addition of Camellia Cipher Suites to Transport Layer Security (TLS)
Extracted elements (12)
This document amends RFC 4132 by adding SHA-2 family counterparts to the original Camellia cipher suites, which used only SHA-1. The motivation is to modernize the cipher suite portfolio as SHA-2 became the preferred hash family for TLS 1.2.
The RSA, DHE_RSA, DH_RSA, DHE_DSS, DH_DSS, and DH_anon key exchanges are performed exactly as defined in RFC 5246, ensuring compatibility with existing TLS implementations for key exchange procedures.
Clients MUST NOT offer the _SHA256 cipher suites if they do not offer TLS 1.2 or later.
Servers that select an earlier version of TLS MUST NOT select one of the _SHA256 cipher suites.
The SHA-256 cipher suites MUST NOT be negotiated by TLS 1.1 or earlier versions.
Cipher suites ending with _SHA use HMAC-SHA1 as the MAC algorithm and the PRF as specified in the applicable TLS version (prior to 1.2).
Cipher suites ending with _SHA256 use HMAC-SHA-256 as the MAC algorithm, and the PRF is the TLS PRF (RFC 5246) with SHA-256 as the hash function, intended for use with TLS 1.2 or later.
RFC 5932 defines 24 Camellia cipher suites for TLS, covering 128-bit and 256-bit key variants with both SHA-1 and SHA-256 MAC algorithms, across RSA, DH_DSS, DH_RSA, DHE_DSS, DHE_RSA, and DH_anon key exchange methods.
The CAMELLIA_128_CBC cipher suites use Camellia in CBC mode with a 128-bit key and 128-bit IV; the CAMELLIA_256_CBC cipher suites use a 256-bit key and 128-bit IV.
IANA updated entries for 12 Camellia cipher suite numbers previously allocated in RFC 4132 (0x00,0x41–0x46 and 0x00,0x84–0x89) to reference RFC 5932, and allocated 12 new numbers (0x00,0xBA–0xBF and 0x00,0xC0–0xC5) in the TLS Cipher Suite Registry for the SHA-256 variants.
At the time of writing, no known weak keys exist for Camellia and no security problems have been found, as evaluated by NESSIE, CRYPTREC, and independent cryptanalysis research. Security issues in TLS more broadly are discussed in RFC 5246 Appendices D, E, and F.
Each cipher suite is identified by a 2-byte TLS CipherSuite value; for example, TLS_RSA_WITH_CAMELLIA_128_CBC_SHA is {0x00, 0x41} and TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256 is {0x00, 0xC0}.