RFC 5288

RFC 5288
Title	RFC 5288
Author	Eric Rescorla, etc.
Year	2008
Status	Standards Track
Category	Internet Standards

RFC 5288 RFC 5288 is a Standards Track specification that defines Advanced Encryption Standard (AES) cipher suites for the Transport Layer Security (TLS) protocol, specifying the use of AES-Galois/Counter Mode (GCM) and AES-Cipher Block Chaining (CBC) modes within TLS. It updates interoperability between implementations by listing specific cipher suite identifiers and algorithmic requirements, influencing deployments across Internet Engineering Task Force working groups such as TLS Working Group, IETF, and organizations like Internet Society. The document impacted software projects and implementations maintained by entities including Mozilla Foundation, Microsoft Corporation, Google LLC, OpenSSL Project, and LibreSSL.

Introduction

RFC 5288 introduces AES-based cipher suites to be used with TLS and Datagram TLS (DTLS), focusing on authenticated encryption and increased performance for network protocols used by Amazon Web Services, Facebook, Twitter, and Netflix. The specification aligns with cryptographic standards from bodies like National Institute of Standards and Technology and recommendations from National Security Agency and complements other IETF documents produced by contributors from RSA Security, Cisco Systems, and academic groups at Massachusetts Institute of Technology and Stanford University.

Background and Purpose

The purpose of RFC 5288 is to specify AES cipher suite identifiers and operational requirements to modernize cryptographic choices for TLS and DTLS used in protocols maintained by World Wide Web Consortium, Internet Engineering Task Force, and deployed by infrastructure providers such as Akamai Technologies and Cloudflare. Historical drivers include vulnerabilities found in earlier suites cited by analyses from CERT Coordination Center, published advisories by OpenBSD Project, and research by cryptographers at University of California, Berkeley and ETH Zurich. RFC 5288 aims to provide interoperability guidance between implementations like GnuTLS, NSS, and BoringSSL and to harmonize with symmetric key standards in use by financial institutions such as SWIFT and Visa Inc..

Technical Specifications

RFC 5288 defines precise parameters for AES modes in the TLS Record Protocol as used by servers and clients including Apache Software Foundation servers, NGINX, and Microsoft Internet Information Services. It mandates nonce construction, key sizes, and IV handling compatible with AES-GCM and AES-CBC modes referenced in publications from NIST, and interacts with authentication frameworks like Secure Shell and session resumption mechanisms used by OpenVPN. The specification references algorithm performance characteristics investigated by researchers at University of Cambridge and cryptanalysis contributed by teams from University College London and École Polytechnique Fédérale de Lausanne.

Cipher Suites and Algorithms

The document assigns numeric identifiers and names to AES cipher suites intended for use with TLS versions implemented in stacks maintained by Apple Inc., IBM, and Oracle Corporation. It enumerates AES-128-GCM, AES-256-GCM, AES-128-CBC, and AES-256-CBC variants and details their interaction with key exchange algorithms such as those from Diffie–Hellman key exchange implementations used by OpenSSL Project and authentication methods relying on X.509 certificates issued by authorities like Let's Encrypt and DigiCert. The specification references symmetric key lengths established by NIST Special Publication 800-57 and complements integrity mechanisms such as HMAC constructions discussed in work by Ron Rivest and teams from MIT Laboratory for Computer Science.

Security Considerations

RFC 5288 discusses security trade-offs between GCM and CBC modes in light of attacks documented by researchers from Royal Holloway, University of London, Princeton University, ETH Zurich, and advisory notices by US-CERT. It addresses side-channel considerations relevant to implementations on platforms like Intel Corporation processors, ARM Holdings architectures, and mitigations suggested by cryptographers affiliated with Microsoft Research and Google Security Team. The document counsels on algorithm agility to accommodate future transitions recommended by groups such as Internet Architecture Board and standards set by International Organization for Standardization.

Implementation and Adoption

Following publication, RFC 5288 was implemented by major TLS libraries and products maintained by OpenSSL Project, GnuTLS, NSS, BoringSSL, Apple Inc.'s Secure Transport, and Microsoft Schannel. Adoption occurred across services run by Google LLC, Amazon Web Services, Cloudflare, Akamai Technologies, and content providers like YouTube and Wikipedia. Deployment considerations included interoperability testing performed at events like IETF Hackathons and compliance assessments by organizations including Payment Card Industry Security Standards Council and auditors at KPMG and EY.

References and Related Documents

RFC 5288 is part of a family of TLS-related specifications alongside documents authored by contributors from IETF, including standards referenced by the TLS Working Group, and intersects with algorithm specifications from NIST, implementation guidance from OpenSSL Project, and academic analyses from Stanford University and ETH Zurich. Related works involve cipher suite listings and security analyses published by IETF and cryptographic recommendations by NIST Special Publication 800-series.

Category:Internet Standards