draft-ietf-tls-camellia-05.txt   draft-ietf-tls-camellia-06.txt 
skipping to change at page 1, line 13 skipping to change at page 1, line 13
INTERNET-DRAFT S. Moriai INTERNET-DRAFT S. Moriai
TLS Working Group Sony Computer Entertainment Inc. TLS Working Group Sony Computer Entertainment Inc.
Expiration Date: March 2005 A. Kato Expiration Date: March 2005 A. Kato
NTT Software Corporation NTT Software Corporation
M. Kanda M. Kanda
Nippon Telegraph and Telephone Corporation Nippon Telegraph and Telephone Corporation
October 2004 October 2004
Addition of Camellia Ciphersuites to Transport Layer Security (TLS) Addition of Camellia Ciphersuites to Transport Layer Security (TLS)
<draft-ietf-tls-camellia-05.txt> <draft-ietf-tls-camellia-06.txt>
Status of this Memo Status of this Memo
By submitting this Internet-Draft, I certify that any applicable By submitting this Internet-Draft, we certify that any applicable
patent or other IPR claims of which I am aware have been patent or other IPR claims of which we am aware have been
disclosed, and any of which I become aware will be disclosed, in disclosed, and any of which we become aware will be disclosed, in
accordance with RFC 3668. accordance with RFC 3668.
This document is an Internet-Draft and is in full conformance with
all provisions of Section 10 of RFC2026.
Internet-Drafts are working documents of the Internet Engineering Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF), its areas, and its working groups. Note that Task Force (IETF), its areas, and its working groups. Note that
other groups may also distribute working documents as Internet- other groups may also distribute working documents as Internet-
Drafts. Drafts.
Internet-Drafts are draft documents valid for a maximum of six Internet-Drafts are draft documents valid for a maximum of six
months and may be updated, replaced, or obsoleted by other documents months and may be updated, replaced, or obsoleted by other
at any time. It is inappropriate to use Internet-Drafts as documents at any time. It is inappropriate to use Internet-Drafts
reference material or to cite them other than as "work in progress". as reference material or to cite them other than as "work in
progress".
The list of current Internet-Drafts can be accessed at The list of current Internet-Drafts can be accessed at
http://www.ietf.org/ietf/1id-abstracts.txt. http://www.ietf.org/ietf/1id-abstracts.txt.
The list of Internet-Draft Shadow Directories can be accessed at The list of Internet-Draft Shadow Directories can be accessed at
http://www.ietf.org/shadow.html. http://www.ietf.org/shadow.html.
Abstract Abstract
This document proposes the addition of new cipher suites to the This document proposes the addition of new cipher suites to the
Transport Layer Security (TLS) protocol to support the Camellia Transport Layer Security (TLS) protocol to support the Camellia
encryption algorithm as a bulk cipher algorithm. encryption algorithm as a bulk cipher algorithm.
1. Introduction 1. Introduction
This document proposes the addition of new cipher suites to the TLS This document proposes the addition of new cipher suites to the
protocol [TLS] to support the Camellia encryption algorithm as a TLS protocol [TLS] to support the Camellia encryption algorithm as
bulk cipher algorithm. This proposal provides a new option for a bulk cipher algorithm. This proposal provides a new option for
fast, efficient, and royalty-free bulk cipher algorithms. fast and efficient bulk cipher algorithms.
Note: This work was done when the first author worked for NTT. Note: This work was done when the first author worked for NTT.
1.1. Camellia 1.1. Camellia
Camellia was selected as a recommended cryptographic primitive by Camellia was selected as a recommended cryptographic primitive by
the EU NESSIE (New European Schemes for Signatures, Integrity and the EU NESSIE (New European Schemes for Signatures, Integrity and
Encryption) project [NESSIE] and included in the list of Encryption) project [NESSIE] and included in the list of
cryptographic techniques for Japanese e-Government systems, which cryptographic techniques for Japanese e-Government systems, which
were selected by the Japan CRYPTREC (Cryptography Research and were selected by the Japan CRYPTREC (Cryptography Research and
skipping to change at page 2, line 27 skipping to change at page 2, line 25
specifications to enable audio-visual and other services based on specifications to enable audio-visual and other services based on
mass-market high volume digital storage in consumer mass-market high volume digital storage in consumer
platforms. Camellia is specified as Ciphersuite in TLS used by platforms. Camellia is specified as Ciphersuite in TLS used by
Phase 1 S-7 (Bi-directional Metadata Delivery Protection) Phase 1 S-7 (Bi-directional Metadata Delivery Protection)
specification and S-5 (TV-Anytime Rights Management and Protection specification and S-5 (TV-Anytime Rights Management and Protection
Information for Broadcast Applications) specification. Camellia Information for Broadcast Applications) specification. Camellia
has been submitted to other several standardization bodies such as has been submitted to other several standardization bodies such as
ISO (ISO/IEC 18033) and IETF S/MIME Mail Security Working Group ISO (ISO/IEC 18033) and IETF S/MIME Mail Security Working Group
[Camellia-CMS]. [Camellia-CMS].
Camellia supports 128-bit block size and 128-, 192-, and 256-bit key Camellia supports 128-bit block size and 128-, 192-, and 256-bit
sizes, i.e. the same interface specifications as the Advanced key sizes, i.e. the same interface specifications as the Advanced
Encryption Standard (AES) [AES]. Encryption Standard (AES) [AES].
Camellia was jointly developed by NTT and Mitsubishi Electric Camellia was jointly developed by NTT and Mitsubishi Electric
Corporation in 2000. It was carefully designed to withstand all Corporation in 2000. It was carefully designed to withstand all
known cryptanalytic attacks and even to have a sufficiently large known cryptanalytic attacks and even to have a sufficiently large
security leeway. It has been scrutinized by worldwide security leeway. It has been scrutinized by worldwide
cryptographic experts. cryptographic experts.
Camellia was also designed to have suitability for both software Camellia was also designed to have suitability for both software
and hardware implementations and to cover all possible encryption and hardware implementations and to cover all possible encryption
skipping to change at page 2, line 51 skipping to change at page 2, line 49
comparable encryption speed in software and hardware. In comparable encryption speed in software and hardware. In
addition, a distinguishing feature is its small hardware design. addition, a distinguishing feature is its small hardware design.
Camellia perfectly meets one of the current TLS market Camellia perfectly meets one of the current TLS market
requirements, where low power consumption is a mandatory requirements, where low power consumption is a mandatory
condition. condition.
The algorithm specification and object identifiers are described The algorithm specification and object identifiers are described
in [Camellia-Desc]. The Camellia homepage, in [Camellia-Desc]. The Camellia homepage,
http://info.isl.ntt.co.jp/camellia/, contains a wealth of http://info.isl.ntt.co.jp/camellia/, contains a wealth of
information about camellia, including detailed specification, information about camellia, including detailed specification,
security analysis, performance figures, reference implementation, security analysis, performance figures, reference implementation
test vectors, and intellectual property information. and test vectors.
1.2. Terminology 1.2. Terminology
The key words "MUST", "MUST NOT", "REQUIRED", "SHOULD", "SHOULD NOT", The key words "MUST", "MUST NOT", "REQUIRED", "SHOULD", "SHOULD
"RECOMMENDED", "MAY", and "OPTIONAL" in this document (in uppercase, NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document (in
as shown) are to be interpreted as described in [RFC2119]. uppercase, as shown) are to be interpreted as described in
[RFC2119].
2. Proposed Cipher Suites 2. Proposed Cipher Suites
The new ciphersuites proposed here have the following definitions: The new ciphersuites proposed here have the following definitions:
CipherSuite TLS_RSA_WITH_CAMELLIA_128_CBC_SHA = { 0x00,0x41 }; CipherSuite TLS_RSA_WITH_CAMELLIA_128_CBC_SHA = { 0x00,0x41 };
CipherSuite TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA = { 0x00,0x42 }; CipherSuite TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA = { 0x00,0x42 };
CipherSuite TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA = { 0x00,0x43 }; CipherSuite TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA = { 0x00,0x43 };
CipherSuite TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA = { 0x00,0x44 }; CipherSuite TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA = { 0x00,0x44 };
CipherSuite TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA = { 0x00,0x45 }; CipherSuite TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA = { 0x00,0x45 };
skipping to change at page 3, line 30 skipping to change at page 3, line 29
CipherSuite TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA = { 0x00,0x87 }; CipherSuite TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA = { 0x00,0x87 };
CipherSuite TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA = { 0x00,0x88 }; CipherSuite TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA = { 0x00,0x88 };
CipherSuite TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA = { 0x00,0x89 }; CipherSuite TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA = { 0x00,0x89 };
3. CipherSuite Definitions 3. CipherSuite Definitions
3.1. Cipher 3.1. Cipher
All the ciphersuites described here use Camellia in cipher block All the ciphersuites described here use Camellia in cipher block
chaining (CBC) mode as a bulk cipher algorithm. Camellia is a chaining (CBC) mode as a bulk cipher algorithm. Camellia is a
128-bit block cipher with 128-, 192-, and 256-bit key sizes, i.e. it 128-bit block cipher with 128-, 192-, and 256-bit key sizes,
supports the same block and key sizes as the Advanced Encryption i.e. it supports the same block and key sizes as the Advanced
Standard (AES). However, this document only defines ciphersuites Encryption Standard (AES). However, this document only defines
for 128- and 256-bit keys as well as AES ciphersuites for TLS ciphersuites for 128- and 256-bit keys as well as AES ciphersuites
[AES-TLS]. They are enough for use in efficient and practical cases for TLS [AES-TLS]. They are enough for use in efficient and
as well as high-security applications. practical cases as well as high-security applications.
Key Expanded Effective IV Block Key Expanded Effective IV Block
Cipher Type Material Key Material Key Bits Size Size Cipher Type Material Key Material Key Bits Size Size
CAMELLIA_128_CBC Block 16 16 128 16 16 CAMELLIA_128_CBC Block 16 16 128 16 16
CAMELLIA_256_CBC Block 32 32 256 16 16 CAMELLIA_256_CBC Block 32 32 256 16 16
3.2. Hash 3.2. Hash
All the ciphersuites described here use SHA-1 [SHA-1] in an HMAC All the ciphersuites described here use SHA-1 [SHA-1] in an HMAC
construction as described in section 5 of [TLS]. construction as described in section 5 of [TLS].
3.3. Key exchange 3.3. Key exchange
The ciphersuites defined here differ in the type of certificate and The ciphersuites defined here differ in the type of certificate
key exchange method. They use the following options: and key exchange method. They use the following options:
CipherSuite Key Exchange Algorithm CipherSuite Key Exchange Algorithm
TLS_RSA_WITH_CAMELLIA_128_CBC_SHA RSA TLS_RSA_WITH_CAMELLIA_128_CBC_SHA RSA
TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA DH_DSS TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA DH_DSS
TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA DH_RSA TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA DH_RSA
TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA DHE_DSS TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA DHE_DSS
TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA DHE_RSA TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA DHE_RSA
TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA DH_anon TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA DH_anon
TLS_RSA_WITH_CAMELLIA_256_CBC_SHA RSA TLS_RSA_WITH_CAMELLIA_256_CBC_SHA RSA
TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA DH_DSS TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA DH_DSS
TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA DH_RSA TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA DH_RSA
TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA DHE_DSS TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA DHE_DSS
TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA DHE_RSA TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA DHE_RSA
TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA DH_anon TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA DH_anon
For the meanings of the terms RSA, DH_DSS, DH_RSA, DHE_DSS, DHE_RSA For the meanings of the terms RSA, DH_DSS, DH_RSA, DHE_DSS,
and DH_anon, please refer to sections 7.4.2 and 7.4.3 of [TLS]. DHE_RSA and DH_anon, please refer to sections 7.4.2 and 7.4.3 of
[TLS].
4. Security Considerations 4. Security Considerations
It is not believed that the new ciphersuites are ever less secure It is not believed that the new ciphersuites are ever less secure
than the corresponding older ones. Camellia is considered to be than the corresponding older ones. Camellia is considered to be
secure, and it has withstood extensive cryptanalytic efforts in secure, and it has withstood extensive cryptanalytic efforts in
several open, worldwide cryptographic evaluation projects several open, worldwide cryptographic evaluation projects
[CRYPTREC][NESSIE]. [CRYPTREC][NESSIE].
At the time of writing this document there are no known weak keys At the time of writing this document there are no known weak keys
skipping to change at page 5, line 17 skipping to change at page 5, line 13
IETF at ietf-ipr@ietf.org. IETF at ietf-ipr@ietf.org.
6. References 6. References
6.1. Normative References 6.1. Normative References
[Camellia-Desc] Matsui, M., Nakajima, J., Moriai, S., "A [Camellia-Desc] Matsui, M., Nakajima, J., Moriai, S., "A
Description of the Camellia Encryption Algorithm", RFC3713, Description of the Camellia Encryption Algorithm", RFC3713,
April 2004. April 2004.
[TLS] T. Dierks, and C. Allen, "The TLS Protocol Version 1.0", RFC [TLS] Dierks, T. and Allen, C. "The TLS Protocol Version 1.0",
2246, January 1999. RFC 2246, January 1999.
[RFC2119] S. Bradner, "Key words for use in RFCs to Indicate [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119, March 1997. Requirement Levels", BCP 14, RFC 2119, March 1997.
6.2. Informative References 6.2. Informative References
[CamelliaTech] Aoki, K., Ichikawa, T., Kanda, M., Matsui, M., [CamelliaTech] Aoki, K., Ichikawa, T., Kanda, M., Matsui, M.,
Moriai, S., Nakajima, J., and Tokita, T., "Camellia: A 128-Bit Moriai, S., Nakajima, J., and Tokita, T., "Camellia: A 128-Bit
Block Cipher Suitable for Multiple Platforms - Design and Block Cipher Suitable for Multiple Platforms - Design and
Analysis -", In Selected Areas in Cryptography, 7th Annual Analysis -", In Selected Areas in Cryptography, 7th Annual
International Workshop, SAC 2000, August 2000, Proceedings, International Workshop, SAC 2000, August 2000, Proceedings,
Lecture Notes in Computer Science 2012, pp.39-56, Lecture Notes in Computer Science 2012, pp.39-56,
Springer-Verlag, 2001. Springer-Verlag, 2001.
[Camellia-CMS] Moriai, S. and Kato, A., "Use of the Camellia [Camellia-CMS] Moriai, S. and Kato, A., "Use of the Camellia
Encryption Algorithm in CMS", January 2004, RFC3657. Encryption Algorithm in CMS", January 2004, RFC3657.
[AES] NIST, FIPS PUB 197, "Advanced Encryption Standard (AES)", [AES] NIST, FIPS PUB 197, "Advanced Encryption Standard (AES)",
November 2001. http://csrc.nist.gov/publications/fips/fips197/ November 2001. http://csrc.nist.gov/publications/fips/fips197/
fips-197.{ps,pdf}. fips-197.{ps,pdf}.
[AES-TLS] P. Chown, "Advanced Encryption Standard (AES) [AES-TLS] Chown, P., "Advanced Encryption Standard (AES)
Ciphersuites for Transport Layer Security (TLS)", RFC 3268, Ciphersuites for Transport Layer Security (TLS)", RFC 3268,
June 2002. June 2002.
[SHA-1] FIPS PUB 180-1, "Secure Hash Standard", National Institute [SHA-1] FIPS PUB 180-1, "Secure Hash Standard", National Institute
of Standards and Technology, U.S. Department of Commerce,April 17, of Standards and Technology, U.S. Department of Commerce,April
1995. 17, 1995.
[CRYPTREC] Information-technology Promotion Agency (IPA), Japan, [CRYPTREC] Information-technology Promotion Agency (IPA), Japan,
CRYPTREC. http://www.ipa.go.jp/security/enc/CRYPTREC/index-e.html. CRYPTREC.
http://www.ipa.go.jp/security/enc/CRYPTREC/index-e.html.
[NESSIE] The NESSIE project (New European Schemes for Signatures, [NESSIE] The NESSIE project (New European Schemes for Signatures,
Integrity and Encryption), Integrity and Encryption),
http://www.cosic.esat.kuleuven.ac.be/nessie/. http://www.cosic.esat.kuleuven.ac.be/nessie/.
[TV-ANYTIME] TV-Anytime Forum, http://www.tv-anytime.org/. [TV-ANYTIME] TV-Anytime Forum, http://www.tv-anytime.org/.
7. Full Copyright Statement 7. Full Copyright Statement
Copyright (C) The Internet Society (2004). This document is Copyright (C) The Internet Society (2004). This document is
subject to the rights, licenses and restrictions contained in BCP subject to the rights, licenses and restrictions contained in BCP
78 and except as set forth therein, the authors retain all their 78 and except as set forth therein, the authors retain all their
rights. rights.
This document and the information contained herein are provided on This document and the information contained herein are provided on
an "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE an "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE
REPRESENTS OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND REPRESENTS OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND
THE INTERNET ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, THE INTERNET ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES,
EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT
 End of changes. 

This html diff was produced by rfcdiff 1.23, available from http://www.levkowetz.com/ietf/tools/rfcdiff/