Subject: [ietf-tls] CipherSuite numbers

From: "Hidenori Ohta" <[email-masked]>
Date: Fri, 10 Nov 2000 22:41:15 +0900

All,

I looked for the list of registered CipherSuite from the web
page of IANA. But I cannot find any information about TLS.
So I picked up the CipherSuite numbers from RFCs and I-Ds.

--- defined CipherSuites ---
TLS_NULL_WITH_NULL_NULL               = { 0x00,0x00 } RFC2246
TLS_RSA_WITH_NULL_MD5                 = { 0x00,0x01 } RFC2246
TLS_RSA_WITH_NULL_SHA                 = { 0x00,0x02 } RFC2246
TLS_RSA_EXPORT_WITH_RC4_40_MD5        = { 0x00,0x03 } RFC2246
TLS_RSA_WITH_RC4_128_MD5              = { 0x00,0x04 } RFC2246
TLS_RSA_WITH_RC4_128_SHA              = { 0x00,0x05 } RFC2246
TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5    = { 0x00,0x06 } RFC2246
TLS_RSA_WITH_IDEA_CBC_SHA             = { 0x00,0x07 } RFC2246
TLS_RSA_EXPORT_WITH_DES40_CBC_SHA     = { 0x00,0x08 } RFC2246
TLS_RSA_WITH_DES_CBC_SHA              = { 0x00,0x09 } RFC2246
TLS_RSA_WITH_3DES_EDE_CBC_SHA         = { 0x00,0x0A } RFC2246
TLS_DH_DSS_EXPORT_WITH_DES40_CBC_SHA  = { 0x00,0x0B } RFC2246
TLS_DH_DSS_WITH_DES_CBC_SHA           = { 0x00,0x0C } RFC2246
TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA      = { 0x00,0x0D } RFC2246
TLS_DH_RSA_EXPORT_WITH_DES40_CBC_SHA  = { 0x00,0x0E } RFC2246
TLS_DH_RSA_WITH_DES_CBC_SHA           = { 0x00,0x0F } RFC2246
TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA      = { 0x00,0x10 } RFC2246
TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA = { 0x00,0x11 } RFC2246
TLS_DHE_DSS_WITH_DES_CBC_SHA          = { 0x00,0x12 } RFC2246
TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA     = { 0x00,0x13 } RFC2246
TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA = { 0x00,0x14 } RFC2246
TLS_DHE_RSA_WITH_DES_CBC_SHA          = { 0x00,0x15 } RFC2246
TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA     = { 0x00,0x16 } RFC2246
TLS_DH_anon_EXPORT_WITH_RC4_40_MD5    = { 0x00,0x17 } RFC2246
TLS_DH_anon_WITH_RC4_128_MD5          = { 0x00,0x18 } RFC2246
TLS_DH_anon_EXPORT_WITH_DES40_CBC_SHA = { 0x00,0x19 } RFC2246
TLS_DH_anon_WITH_DES_CBC_SHA          = { 0x00,0x1A } RFC2246
TLS_DH_anon_WITH_3DES_EDE_CBC_SHA     = { 0x00,0x1B } RFC2246
*** Reserved for Fortezza-based CS ***  { 0x00,0x1C } RFC2246
*** Reserved for Fortezza-based CS ***  { 0x00,0x1D } RFC2246
TLS_KRB5_WITH_DES_CBC_SHA             = { 0x00,0x1E } RFC2712
TLS_KRB5_WITH_3DES_EDE_CBC_SHA        = { 0x00,0x1F } RFC2712
TLS_KRB5_WITH_RC4_128_SHA             = { 0x00,0x20 } RFC2712
TLS_KRB5_WITH_IDEA_CBC_SHA            = { 0x00,0x21 } RFC2712
TLS_KRB5_WITH_DES_CBC_MD5             = { 0x00,0x22 } RFC2712
TLS_KRB5_WITH_3DES_EDE_CBC_MD5        = { 0x00,0x23 } RFC2712
TLS_KRB5_WITH_RC4_128_MD5             = { 0x00,0x24 } RFC2712
TLS_KRB5_WITH_IDEA_CBC_MD5            = { 0x00,0x25 } RFC2712

TLS_KRB5_EXPORT_WITH_DES_CBC_40_SHA   = { 0x00,0x26 } RFC2712
TLS_KRB5_EXPORT_WITH_RC2_CBC_40_SHA   = { 0x00,0x27 } RFC2712
TLS_KRB5_EXPORT_WITH_RC4_40_SHA       = { 0x00,0x28 } RFC2712
TLS_KRB5_EXPORT_WITH_DES_CBC_40_MD5   = { 0x00,0x29 } RFC2712
TLS_KRB5_EXPORT_WITH_RC2_CBC_40_MD5   = { 0x00,0x2A } RFC2712
TLS_KRB5_EXPORT_WITH_RC4_40_MD5       = { 0x00,0x2B } RFC2712

--- proposed CipherSuites ---
TLS_RSA_WITH_SEED_CBC_MD5             = { 0x00,0x2C }
TLS_RSA_WITH_SEED_CBC_SHA             = { 0x00,0x2D }
TLS_RSA_WITH_SEED_CBC_HAS160          = { 0x00,0x2E }

TLS_RSA_WITH_AES_128_CBC_SHA          = { 0x00,0x2F }
TLS_DH_DSS_WITH_AES_128_CBC_SHA       = { 0x00,0x30 }
TLS_DH_RSA_WITH_AES_128_CBC_SHA       = { 0x00,0x31 }
TLS_DHE_DSS_WITH_AES_128_CBC_SHA      = { 0x00,0x32 }
TLS_DHE_RSA_WITH_AES_128_CBC_SHA      = { 0x00,0x33 }

TLS_RSA_WITH_CAMELLIA_CBC_128_SHA     = { 0x00,0x2F }
TLS_DH_DSS_WITH_CAMELLIA_CBC_128_SHA  = { 0x00,0x30 }
TLS_DH_RSA_WITH_CAMELLIA_CBC_128_SHA  = { 0x00,0x31 }
TLS_DHE_DSS_WITH_CAMELLIA_CBC_128_SHA = { 0x00,0x32 }
TLS_DHE_RSA_WITH_CAMELLIA_CBC_128_SHA = { 0x00,0x33 }
TLS_DH_anon_WITH_CAMELLIA_CBC_128_SHA = { 0x00,0x34 }
TLS_RSA_WITH_CAMELLIA_CBC_192_SHA     = { 0x00,0x35 }
TLS_DH_DSS_WITH_CAMELLIA_CBC_192_SHA  = { 0x00,0x36 }
TLS_DH_RSA_WITH_CAMELLIA_CBC_192_SHA  = { 0x00,0x37 }
TLS_DHE_DSS_WITH_CAMELLIA_CBC_192_SHA = { 0x00,0x38 }
TLS_DHE_RSA_WITH_CAMELLIA_CBC_192_SHA = { 0x00,0x39 }
TLS_DH_anon_WITH_CAMELLIA_CBC_192_SHA = { 0x00,0x3A }
TLS_RSA_WITH_CAMELLIA_CBC_256_SHA     = { 0x00,0x3B }
TLS_DH_DSS_WITH_CAMELLIA_CBC_256_SHA  = { 0x00,0x3C }
TLS_DH_RSA_WITH_CAMELLIA_CBC_256_SHA  = { 0x00,0x3D }
TLS_DHE_DSS_WITH_CAMELLIA_CBC_256_SHA = { 0x00,0x3E }
TLS_DHE_RSA_WITH_CAMELLIA_CBC_256_SHA = { 0x00,0x3F }
TLS_DH_anon_WITH_CAMELLIA_CBC_256_SHA = { 0x00,0x40 }

TLS_RSA_WITH_MISTY1_CBC_SHA           = { 0x00,0xXX }
TLS_DH_DSS_WITH_MISTY1_CBC_SHA        = { 0x00,0xXX }
TLS_DH_RSA_WITH_MISTY1_CBC_SHA        = { 0x00,0xXX }
TLS_DHE_DSS_WITH_MISTY1_CBC_SHA       = { 0x00,0xXX }
TLS_DHE_RSA_WITH_MISTY1_CBC_SHA       = { 0x00,0xXX }
TLS_DH_anon_WITH_MISTY1_CBC_SHA       = { 0x00,0xXX }

TLS_KRB5_WITH_NULL_SHA                = { 0x00,0x?? }
TLS_KRB5_WITH_NULL_MD5                = { 0x00,0x?? }
TLS_KRB5_WITH_NULL_NULL               = { 0x00,0x?? }

As you know, some proposed CipherSuites have no number, and
some numbers conflict.
I think we must re-allocate and allocate the numbers for
proposed CipherSuites.
We have 2 possibilities of allocating method.

1:
We will give high-priority to AES, and AES will be allocated
lower numbers.

2:
We will fix only the conflicted CipherSuites.

There are the lists that follow the possibilities.

List 1:
TLS_RSA_WITH_AES_128_CBC_SHA          = { 0x00,0x2C }
TLS_DH_DSS_WITH_AES_128_CBC_SHA       = { 0x00,0x2D }
TLS_DH_RSA_WITH_AES_128_CBC_SHA       = { 0x00,0x2E }
TLS_DHE_DSS_WITH_AES_128_CBC_SHA      = { 0x00,0x2F }
TLS_DHE_RSA_WITH_AES_128_CBC_SHA      = { 0x00,0x30 }
TLS_RSA_WITH_SEED_CBC_MD5             = { 0x00,0x31 }
TLS_RSA_WITH_SEED_CBC_SHA             = { 0x00,0x32 }
TLS_RSA_WITH_SEED_CBC_HAS160          = { 0x00,0x33 }
TLS_RSA_WITH_MISTY1_CBC_SHA           = { 0x00,0x34 }
TLS_DH_DSS_WITH_MISTY1_CBC_SHA        = { 0x00,0x35 }
TLS_DH_RSA_WITH_MISTY1_CBC_SHA        = { 0x00,0x36 }
TLS_DHE_DSS_WITH_MISTY1_CBC_SHA       = { 0x00,0x37 }
TLS_DHE_RSA_WITH_MISTY1_CBC_SHA       = { 0x00,0x38 }
TLS_RSA_WITH_CAMELLIA_CBC_128_SHA     = { 0x00,0x39 }
TLS_DH_DSS_WITH_CAMELLIA_CBC_128_SHA  = { 0x00,0x3A }
TLS_DH_RSA_WITH_CAMELLIA_CBC_128_SHA  = { 0x00,0x3B }
TLS_DHE_DSS_WITH_CAMELLIA_CBC_128_SHA = { 0x00,0x3C }
TLS_DHE_RSA_WITH_CAMELLIA_CBC_128_SHA = { 0x00,0x3D }
TLS_RSA_WITH_CAMELLIA_CBC_192_SHA     = { 0x00,0x3E }
TLS_DH_DSS_WITH_CAMELLIA_CBC_192_SHA  = { 0x00,0x3F }
TLS_DH_RSA_WITH_CAMELLIA_CBC_192_SHA  = { 0x00,0x40 }
TLS_DHE_DSS_WITH_CAMELLIA_CBC_192_SHA = { 0x00,0x41 }
TLS_DHE_RSA_WITH_CAMELLIA_CBC_192_SHA = { 0x00,0x42 }
TLS_RSA_WITH_CAMELLIA_CBC_256_SHA     = { 0x00,0x43 }
TLS_DH_DSS_WITH_CAMELLIA_CBC_256_SHA  = { 0x00,0x44 }
TLS_DH_RSA_WITH_CAMELLIA_CBC_256_SHA  = { 0x00,0x45 }
TLS_DHE_DSS_WITH_CAMELLIA_CBC_256_SHA = { 0x00,0x46 }
TLS_DHE_RSA_WITH_CAMELLIA_CBC_256_SHA = { 0x00,0x47 }
TLS_KRB5_WITH_NULL_SHA                = { 0x00,0x48 }
TLS_KRB5_WITH_NULL_MD5                = { 0x00,0x49 } [delete?]
TLS_KRB5_WITH_NULL_NULL               = { 0x00,0x4A } [delete?]

List 2:
TLS_RSA_WITH_SEED_CBC_MD5             = { 0x00,0x2C }
TLS_RSA_WITH_SEED_CBC_SHA             = { 0x00,0x2D }
TLS_RSA_WITH_SEED_CBC_HAS160          = { 0x00,0x2E }
TLS_RSA_WITH_AES_128_CBC_SHA          = { 0x00,0x2F }
TLS_DH_DSS_WITH_AES_128_CBC_SHA       = { 0x00,0x30 }
TLS_DH_RSA_WITH_AES_128_CBC_SHA       = { 0x00,0x31 }
TLS_DHE_DSS_WITH_AES_128_CBC_SHA      = { 0x00,0x32 }
TLS_DHE_RSA_WITH_AES_128_CBC_SHA      = { 0x00,0x33 }
    [ following #'s are same as List 1]

How do you think of them?

regards
--
Hidenori Ohta
Mitsubishi Electric Corporation
e-mail: [email-masked]

---
You are currently subscribed to ietf-tls as: [email-masked]
To unsubscribe send a blank email to [email-masked]

---

From: Mathieu Arnold <[email-masked]>
Date: Fri, 10 Nov 2000 16:09:30 +0100

> So I picked up the CipherSuite numbers from RFCs and I-Ds.

have a look at the 2246 RFC...

Network Working Group                                         T. Dierks
Request for Comments: 2246                                     Certicom
Category: Standards Track                                      C. Allen
                                                               Certicom
                                                           January 1999

                            The TLS Protocol
                              Version 1.0

Status of this Memo

   This document specifies an Internet standards track protocol for the
   Internet community, and requests discussion and suggestions for
   improvements.  Please refer to the current edition of the "Internet
   Official Protocol Standards" (STD 1) for the standardization state
   and status of this protocol.  Distribution of this memo is unlimited.

Copyright Notice

   Copyright (C) The Internet Society (1999).  All Rights Reserved.

Abstract

   This document specifies Version 1.0 of the Transport Layer Security
   (TLS) protocol. The TLS protocol provides communications privacy over
   the Internet. The protocol allows client/server applications to
   communicate in a way that is designed to prevent eavesdropping,
   tampering, or message forgery.

-- 
Mathieu Arnold

---