It seems the only specified CTR mode ciphers in TLS are all GCM based.
GCM ciphers run AES-CTR
and do authenticated encryption with a MAC based on Galois-field arithmetic ("GHASH") - and the latter seems to be difficult to get right in software (side-channel attacks, constant time) or require CPU hardware support (e.g. Intel AES-NI / PCLMULQDQ) which in turn might be manipulated/weakened via microcode updates/implants.
On the other hand HMAC-SHA256
seems relatively simple to do right in software and when used together with AES-CTR and a encrypt-then-MAC scheme.
So why are there no modes like TLS_DHE_RSA_AES128_SHA256
?
The closest I could find is this unfinished, expired IETF draft.
SHA256
is unacceptably slow - think 13 cycles/byte minimum (on top of the encryption cost). $\endgroup$ – orlp Oct 27 '13 at 9:16AES-CBC-(HMAC)-SHA256
has that too, doesn't it? AndSHA1
is less secure. And then you could have aAES-CTR-(HMAC)-SHA1
also. And the alternative ofAEAD
likeAES-GCM
is very new and not yet widely available. $\endgroup$ – oberstet Oct 27 '13 at 10:55