6.2.9 and CCM-8

[randomstuff]

Since #2482, 6.2.9 is:

6.2.9 [ADDED] Verify that all cryptographic primitives utilize a minimum of 128-bits of security based on the algorithm, key size, and configuration. For example, a 256-bit ECC key provides roughly 128 bits of security where RSA requires a 3072-bit key to achieve 128 bits of security.

CCM-8 is still listed in the approved algorithms. However, its authentication tag only has 64 bits of security and does not respect this minimum of 128-bits of security.

There seems to be a conflict between these. How should be fix this?

Possible options:

• add some exception in 6.2.9 in order to allow CCM-8 in certain contexts ("unless some additional measure to prevent forgery of messages is used");
• do not approve CCM-8.

I don't have a strong opinion on this and I don't know if CCM-8 is really used/useful nowadays. The safest choice seems to disapprove CCM-8. Unless/until someone come forwards with further input, I would suggest taking this approach.

See as well discussion in #2413 for more info about CCM-8.

[jmanico]

Seems like getting rid of it is the right way to go.

[tghosth]

@randomstuff can you prepare a PR that captures the feedback from this issue and also #2143.

Does using the disclaimer from here help with this issue?
#2413 (comment)

It sounds like they did have a reason for including it so I would be cautious about reversing it.

[tghosth]

Ping @randomstuff :)

[randomstuff]

Woops sorry, I'll do that!

By the way, I think you linked to the wrong issue in your previous comment :)

[randomstuff]

@unprovable, any opinion on this?

[randomstuff]

I searched https://clienttest.ssllabs.com:8443 and did not find a client with support for this (is it supported by the TLS client test?). I made a PR to disapprove it. I believe it won't be missed.

If anyone thinks it should be approved, please comment here.