Use of KCipher-2 with Poly1305 in Transport Layer Security
draft-kiyomoto-kcipher2-tls-02

Abstract

This document describes the use of the KCipher-2 stream cipher with Poly1305 in Transport Layer Security (TLS) protocols version 1.2 and Datagram Transport Layer Security (DTLS) protocols. KCipher-2 is a stream cipher with a 128-bit key and a 128-bit initialization vector, which provides fast, efficient encryption and decryption.

Status of This Memo

This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79.

Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet-Drafts is at http://datatracker.ietf.org/drafts/current/.

Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress."

This Internet-Draft will expire on May 5, 2016.

Copyright Notice

Copyright (c) 2015 IETF Trust and the persons identified as the document authors. All rights reserved.

This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License.

Table of Contents

• 1. Introduction
• 1.1. KCipher2
• 1.2. Poly1305 Authenticator
• 1.3. Terminology
• 2. Cipher Suites Values
• 3. Cipher Suite Definitions
• 3.1. Key Exchange
• 3.2. Cipher
• 3.3. Pseudorandom Function
• 3.4. AEAD Construction
• 4. Security Considerations
• 5. IANA Considerations
• 6. Acknowledgements
• 7. References
• 7.1. Normative References
• 7.2. Informative References
• Authors' Addresses

1. Introduction

This document describes the use of the KCipher-2 [RFC7008] in the Transport Layer Security (TLS) version 1.2 [RFC5246] protocol, as well as in the Datagram Transport Layer Security (DTLS) version 1.2 [RFC6347], or any later versions.

Cryptographic operations used in TLS can be categorized in five ways: digital signing, stream cipher encryption, block cipher encryption, authenticated encryption with additional data encryption, and public key encryption [RFC5246]. This document defines the cipher suites to use KCipher-2 for stream cipher encryption in TLS. KCipher-2 is a fast, secure stream cipher algorithm as well as ChaCha20 [ChaCha20].

1.1. KCipher2

KCipher-2 is a stream cipher algorithm with a 128-bit key and a 128-bit initialization vector (IV). The algorithm and other properties are described in [SECRYPT]. KCipher-2 has been evaluated by the cryptographic technique evaluation project for the Japanese e-Government [CRYPTREC]. KCipher-2 also has been submitted to another international standardization body [ISO18033].

1.2. Poly1305 Authenticator

Poly1305 [POLY1305] is a Wegman-Carter, one-time authenticator designed by D. J. Bernstein. In details, Poly1305 is described in Section 2.5 and 2.6 of [RFC7539] .

1.3. Terminology

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [RFC2119].

2. Cipher Suites Values

The following are proposed identifiers and values for the cipher suites of TLS.

    CipherSuite TLS_ECDHE_RSA_WITH_KCIPHER2_128_POLY1305   = { TBD, TBD };
    CipherSuite TLS_ECDHE_ECDSA_WITH_KCIPHER2_128_POLY1305 = { TBD, TBD };
    CipherSuite TLS_DHE_RSA_WITH_KCIPHER2_128_POLY1305     = { TBD, TBD };
    

3. Cipher Suite Definitions

3.1. Key Exchange

The DHE_RSA, ECDHE_RSA, and ECDHE_ECDSA key exchanges are performed as defined in [RFC5246] and [RFC4496].

3.2. Cipher

The KCIPHER2_128 cipher suites use KCipher-2 with a 128-bit key and a 128-bit initialization vector.

3.3. Pseudorandom Function

For the cipher suites in this document, [RFC2104] based on SHA-256 is used for TLS PseudoRandom Function (PRF) [RFC5246] with SHA-256 is used as the PRF.

3.4. AEAD Construction

KCIPHER2_128_POLY1305 is an authenticated encryption with additional data algorithm. The KCipher-2 and Poly1305 [POLY1305]primitives are combined into an AEAD.

4. Security Considerations

As of the time this document was written, we are not aware of any attack on KCipher-2. No security vulnerabilities have been identified in the security evaluations by the KCipher-2 developers and other independent institutions [SECRYPT], [CRYPTREC10], and [KDDI].

Poly1305 is designed to ensure that forged messages are rejected with a probability of 1-(n/2^102) for a 16*n byte message, even after sending 2^64 legitimate messages.

5. IANA Considerations

IANA is requested to allocate the following numbers in the TLS Cipher Suite Registry:

    CipherSuite TLS_ECDHE_RSA_WITH_KCIPHER2_128_POLY1305   = { TBD, TBD };
    CipherSuite TLS_ECDHE_ECDSA_WITH_KCIPHER2_128_POLY1305 = { TBD, TBD };
    CipherSuite TLS_DHE_RSA_WITH_KCIPHER2_128_POLY1305     = { TBD, TBD };
    

6. Acknowledgements

Thanks to Marshall Rose for developing the XML2RFC format.

Thanks to Shinsaku Kiyomoto who is an author of draft-kiyomoto-kcipher2-tls-01.txt.

7. References

7.1. Normative References

7.2. Informative References

Authors' Addresses