RFC 5932

Camellia Cipher Suites for TLS

📅 published June 2010, from ietf

Camellia Cipher Suites for TLS 💖

Okay, bestie, this is RFC 5932, and it's a Standards Track doc from the IETF, published June 2010 🎀

  • Authors: A. Kato (NTT Software Corporation), M. Kanda (NTT), and S. Kanno (NTT Software Corporation)
  • Category: Standards Track
  • Date: June 2010
  • ISSN: 2070-1721
  • Obsoletes: RFC 4132 (so this one replaces it, no cap)
  • Updates: nothing listed in the title block

Abstract ✨

Okay so this spec adds a bunch of new cipher suites to TLS so it can use Camellia as a block cipher 🦋 It also brings in matching versions that use the newer SHA-2 hash family, which basically upgrades the RFC 4132 lineup. This doc obsoletes RFC 4132, periodt.

Status of This Memo 📜

This is an Internet Standards Track document.

It's a product of the IETF and represents the consensus of the IETF community. It got public review and was approved for publication by the IESG. If you want more info on Internet Standards, check out Section 2 of RFC 5741.

Info on this doc's current status, any errata, and how to send feedback lives at http://www.rfc-editor.org/info/rfc5932.

Copyright (c) 2010 IETF Trust and the persons identified as the document authors. All rights reserved.

This doc is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) as they stand on the publication date. Please read these carefully, because they spell out your rights and restrictions for this document. Code Components pulled from this doc must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions, and they come without warranty, as the Simplified BSD License describes.

This doc may include material from IETF Documents or IETF Contributions published or made publicly available before November 10, 2008. The people who control the copyright in some of that material may not have granted the IETF Trust permission to allow modifications outside the IETF Standards Process. Unless you get an adequate license from those copyright holders, this doc may not be modified outside the IETF Standards Process, and derivative works of it may not be created outside the IETF Standards Process. The only exceptions are formatting it for publication as an RFC or translating it into languages other than English.

1. Introduction ✨

So this doc proposes adding new cipher suites to the Transport Layer Security (TLS) [RFC5246] protocol so it can use the Camellia [RFC3713] encryption algorithm as a block cipher. It also adds variants that use the SHA-2 family of hash algorithms [FIPS180-3] to the TLS cipher suite lineup that RFC 4132 [RFC4132] originally set up. And yes, this doc obsoletes RFC 4132 🌸

The Camellia algorithm and its properties are described in [RFC3713].

1.1. Terminology

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [RFC2119].

2. Proposed Cipher Suites 🧚

The cipher suites defined here have these identifiers:

  CipherSuite TLS_RSA_WITH_CAMELLIA_128_CBC_SHA         = { 0x00,0x41 };
  CipherSuite TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA      = { 0x00,0x42 };
  CipherSuite TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA      = { 0x00,0x43 };
  CipherSuite TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA     = { 0x00,0x44 };
  CipherSuite TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA     = { 0x00,0x45 };
  CipherSuite TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA     = { 0x00,0x46 };

  CipherSuite TLS_RSA_WITH_CAMELLIA_256_CBC_SHA         = { 0x00,0x84 };
  CipherSuite TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA      = { 0x00,0x85 };
  CipherSuite TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA      = { 0x00,0x86 };
  CipherSuite TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA     = { 0x00,0x87 };
  CipherSuite TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA     = { 0x00,0x88 };
  CipherSuite TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA     = { 0x00,0x89 };
  CipherSuite TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256      = { 0x00,0xBA };
  CipherSuite TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA256   = { 0x00,0xBB };
  CipherSuite TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA256   = { 0x00,0xBC };
  CipherSuite TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA256  = { 0x00,0xBD };
  CipherSuite TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256  = { 0x00,0xBE };
  CipherSuite TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA256  = { 0x00,0xBF };

  CipherSuite TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256      = { 0x00,0xC0 };
  CipherSuite TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA256   = { 0x00,0xC1 };
  CipherSuite TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA256   = { 0x00,0xC2 };
  CipherSuite TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA256  = { 0x00,0xC3 };
  CipherSuite TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256  = { 0x00,0xC4 };
  CipherSuite TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA256  = { 0x00,0xC5 };

3. Cipher Suite Definitions 💅

3.1. Key Exchange

The RSA, DHE_RSA, DH_RSA, DHE_DSS, DH_DSS, and DH_anon key exchanges work exactly as defined in [RFC5246] 🔥

3.2. Cipher

The CAMELLIA_128_CBC cipher suites use Camellia [RFC3713] in Cipher Block Chaining (CBC) mode with a 128-bit key and 128-bit IV. The CAMELLIA_256_CBC cipher suites use a 256-bit key and a 128-bit IV 🌈

3.3. Hash and Pseudorandom Function

3.3.1. Hash and Pseudorandom Function for TLS 1.1

The cipher suites ending with _SHA use HMAC-SHA1 as the MAC algorithm.

When used with TLS versions prior to 1.2, the pseudorandom function (PRF) is calculated as specified in the appropriate version of the TLS specification.

3.3.2. Hash and Pseudorandom Function for TLS 1.2

The cipher suites ending with _SHA256 use HMAC-SHA-256 as the MAC algorithm. The PRF is the TLS PRF [RFC5246] with SHA-256 as the hash function. These cipher suites MUST NOT be negotiated by TLS 1.1 or earlier versions. Clients MUST NOT offer these cipher suites if they do not offer TLS 1.2 or later. Servers that select an earlier version of TLS MUST NOT select one of these cipher suites.

This part is important, bestie. The SHA-256 suites need TLS 1.2 or later, so don't let them slip into an older handshake 🙈

4. IANA Considerations 🦋

IANA updated the entries for the following numbers that were allocated in RFC 4132 so they point to this document:

  CipherSuite TLS_RSA_WITH_CAMELLIA_128_CBC_SHA         = { 0x00,0x41 };
  CipherSuite TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA      = { 0x00,0x42 };
  CipherSuite TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA      = { 0x00,0x43 };
  CipherSuite TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA     = { 0x00,0x44 };
  CipherSuite TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA     = { 0x00,0x45 };
  CipherSuite TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA     = { 0x00,0x46 };

  CipherSuite TLS_RSA_WITH_CAMELLIA_256_CBC_SHA         = { 0x00,0x84 };
  CipherSuite TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA      = { 0x00,0x85 };
  CipherSuite TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA      = { 0x00,0x86 };
  CipherSuite TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA     = { 0x00,0x87 };
  CipherSuite TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA     = { 0x00,0x88 };
  CipherSuite TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA     = { 0x00,0x89 };

IANA also allocated the following numbers in the TLS Cipher Suite Registry:

  CipherSuite TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256      = { 0x00,0xBA };
  CipherSuite TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA256   = { 0x00,0xBB };
  CipherSuite TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA256   = { 0x00,0xBC };
  CipherSuite TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA256  = { 0x00,0xBD };
  CipherSuite TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256  = { 0x00,0xBE };
  CipherSuite TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA256  = { 0x00,0xBF };

  CipherSuite TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256      = { 0x00,0xC0 };
  CipherSuite TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA256   = { 0x00,0xC1 };
  CipherSuite TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA256   = { 0x00,0xC2 };
  CipherSuite TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA256  = { 0x00,0xC3 };
  CipherSuite TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256  = { 0x00,0xC4 };
  CipherSuite TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA256  = { 0x00,0xC5 };

5. Security Considerations 🙈

At the time this document was written, there are no known weak keys for Camellia, and no security problem has been found on Camellia (see [NESSIE], [CRYPTREC], and [LNCS]).

Security issues are also discussed throughout RFC 5246 [RFC5246], especially in Appendices D, E, and F. Read those too, seriously, because TLS security is no joke 💀

6. References 📚

6.1. Normative References

6.2. Informative References

Authors' Addresses 💌

Here's how to reach the authors:

Akihiro Kato
NTT Software Corporation

Phone: +81-45-212-9803
Fax:   +81-45-212-9800
EMail: kato.akihiro@po.ntts.co.jp


Masayuki Kanda
NTT

Phone: +81-422-59-3456
Fax:   +81-422-59-4015
EMail: kanda.masayuki@lab.ntt.co.jp


Satoru Kanno
NTT Software Corporation

Phone: +81-45-212-9803
Fax:   +81-45-212-9800
EMail: kanno.satoru@po.ntts.co.jp
📦 where this page comes from