AES Galois Counter Mode (GCM) Cipher Suites for TLS
RFC 5288

Network Working Group                                         J. Salowey
Request for Comments: 5288                                  A. Choudhury
Category: Standards Track                                      D. McGrew
                                                     Cisco Systems, Inc.
                                                             August 2008

          AES Galois Counter Mode (GCM) Cipher Suites for TLS

Status of This Memo

   This document specifies an Internet standards track protocol for the
   Internet community, and requests discussion and suggestions for
   improvements.  Please refer to the current edition of the "Internet
   Official Protocol Standards" (STD 1) for the standardization state
   and status of this protocol.  Distribution of this memo is unlimited.

Abstract

   This memo describes the use of the Advanced Encryption Standard (AES)
   in Galois/Counter Mode (GCM) as a Transport Layer Security (TLS)
   authenticated encryption operation.  GCM provides both
   confidentiality and data origin authentication, can be efficiently
   implemented in hardware for speeds of 10 gigabits per second and
   above, and is also well-suited to software implementations.  This
   memo defines TLS cipher suites that use AES-GCM with RSA, DSA, and
   Diffie-Hellman-based key exchange mechanisms.

Table of Contents

   1.  Introduction  . . . . . . . . . . . . . . . . . . . . . . . . . 2
   2.  Conventions Used in This Document . . . . . . . . . . . . . . . 2
   3.  AES-GCM Cipher Suites . . . . . . . . . . . . . . . . . . . . . 2
   4.  TLS Versions  . . . . . . . . . . . . . . . . . . . . . . . . . 3
   5.  IANA Considerations . . . . . . . . . . . . . . . . . . . . . . 4
   6.  Security Considerations . . . . . . . . . . . . . . . . . . . . 4
     6.1.  Counter Reuse . . . . . . . . . . . . . . . . . . . . . . . 4
     6.2.  Recommendations for Multiple Encryption Processors  . . . . 4
   7.  Acknowledgements  . . . . . . . . . . . . . . . . . . . . . . . 5
   8.  References  . . . . . . . . . . . . . . . . . . . . . . . . . . 6
     8.1.  Normative References  . . . . . . . . . . . . . . . . . . . 6
     8.2.  Informative References  . . . . . . . . . . . . . . . . . . 6

Salowey, et al.             Standards Track                     [Page 1]
RFC 5288                 AES-GCM Cipher suites               August 2008

1.  Introduction

   This document describes the use of AES [AES] in Galois Counter Mode
   (GCM) [GCM] (AES-GCM) with various key exchange mechanisms as a
   cipher suite for TLS.  AES-GCM is an authenticated encryption with
   associated data (AEAD) cipher (as defined in TLS 1.2 [RFC5246])
   providing both confidentiality and data origin authentication.  The
   following sections define cipher suites based on RSA, DSA, and
   Diffie-Hellman key exchanges; ECC-based (Elliptic Curve Cryptography)
   cipher suites are defined in a separate document [RFC5289].

   AES-GCM is not only efficient and secure, but hardware
   implementations can achieve high speeds with low cost and low
   latency, because the mode can be pipelined.  Applications that
   require high data throughput can benefit from these high-speed
   implementations.  AES-GCM has been specified as a mode that can be
   used with IPsec ESP [RFC4106] and 802.1AE Media Access Control (MAC)
   Security [IEEE8021AE].

2.  Conventions Used in This Document

   The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
   "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
   document are to be interpreted as described in [RFC2119].

3.  AES-GCM Cipher Suites

   The following cipher suites use the new authenticated encryption
   modes defined in TLS 1.2 with AES in Galois Counter Mode (GCM) [GCM]:

      CipherSuite TLS_RSA_WITH_AES_128_GCM_SHA256 = {0x00,0x9C}
      CipherSuite TLS_RSA_WITH_AES_256_GCM_SHA384 = {0x00,0x9D}
      CipherSuite TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 = {0x00,0x9E}
      CipherSuite TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 = {0x00,0x9F}
      CipherSuite TLS_DH_RSA_WITH_AES_128_GCM_SHA256 = {0x00,0xA0}
      CipherSuite TLS_DH_RSA_WITH_AES_256_GCM_SHA384 = {0x00,0xA1}
      CipherSuite TLS_DHE_DSS_WITH_AES_128_GCM_SHA256 = {0x00,0xA2}
      CipherSuite TLS_DHE_DSS_WITH_AES_256_GCM_SHA384 = {0x00,0xA3}
      CipherSuite TLS_DH_DSS_WITH_AES_128_GCM_SHA256 = {0x00,0xA4}
      CipherSuite TLS_DH_DSS_WITH_AES_256_GCM_SHA384 = {0x00,0xA5}
      CipherSuite TLS_DH_anon_WITH_AES_128_GCM_SHA256 = {0x00,0xA6}
      CipherSuite TLS_DH_anon_WITH_AES_256_GCM_SHA384 = {0x00,0xA7}

   These cipher suites use the AES-GCM authenticated encryption with
   associated data (AEAD) algorithms AEAD_AES_128_GCM and