Crypto appendix - mention missing mechanisms

[randomstuff]

The following mechanisms are not mentioned and may (?) be missing.

Stream ciphers:

• Salsa20
• XSalsa20 (useful to mention explicitly?) (used in libsodium)
• XChaCha20 (useful to mention explicitly?)

Block ciphers (found in the recommended TLS ciphersuites, are they used in practice?):

• ARIA
• Camellia

→ I did not find much usage of these two. Browsers don't advertise them in TLS ciphersuites for example. We can probably skip mentioning them for now.

Hash:

• Blake2 (used in libsodium, PASETO v4)
• Blake3

Key Exchange:

• XEdDSA (XEd25519, XEd448) (https://signal.org/docs/specifications/xeddsa/#xeddsa)?

Moreover (and for better PQC compliance), I would remove:

Any other cipher options MUST NOT be used.

[...]

Any other method for key wrapping MUST NOT be used.

[danielcuthbert]

We love PR's btw ;) #justsaying

[randomstuff]

Yes, I thought it would be better to have this discussed before PR but this could directly be discussed in a PR instead…

[elarlang]

Yes, I thought it would be better to have this discussed before PR but this could directly be discussed in a PR instead…

That (agreement in an issue first) is the correct procedure.

[danielcuthbert]

@randomstuff I'd love your help making these please, if you have time?

[randomstuff]

@danielcuthbert, OK, I'll try to do that. I think I'd start by including all the things I've mentioned except maybe ARIA and Camellia which appears to quite niche in term of usage but I'm open to any feedback on this.

[randomstuff]

Some additional things not mentioned which might be relevant.

MAC:

• Poly1305, approved
  • This one is important because it is used in current TLS ciphersuites.
  • note that this uses a nonce
• CMAC, approved
• CBC-MAC, not approved
• GMAC, approved
• Prefix-MAC, not approved (do we ned to mention this?)
• Suffix-MAC, not approved (do we ned to mention this?)

Public-key encryption:

• Plain/textbook RSA, not approved 😄
• RSAES-PKCS1-v1_5, not approved
• RSAES-OAEP, approved
• Diffie Hellman KEM (DLIES-KEM, ECIES-KEM), approved
  • this is used by HPKE which is used in Encrypted Client Hello

@danielcuthbert, do you agree it makes sense to mention these?