Re: [kitten] WGLC on draft-ietf-kitten-aes-cts-hmac-sha2-06

[Viktor Dukhovni <[e-mail]>]

On Wed, Apr 15, 2015 at 10:20:56PM -0400, Michael Peck wrote:

> 1. HMAC-SHA-384 truncated to 192 bits versus HMAC-SHA-256 truncated to 192
> bits :
> 
> Suite B was our motivation for proposing the two encryption types.
> Suite B pairs AES-128 with SHA-256, and pairs AES-256 with SHA-384.  When
> used in the digital signature context, SHA-256 provides an expected 128 bit
> security level, and SHA-384 an expected 192 bit security level because of
> the dependence on collision resistance.
> In the case of our proposed Kerberos enctypes, we're using the hashes with
> HMAC for message authentication and for a KDF so collision resistance is
> not a factor - in this case, SHA-384 truncated to 192 bits appears to add
> no cryptographic value over SHA-256 truncated to 192 bits.
> However, our preference would still be to keep the hash choice as is for
> consistency with the Suite B pairing of AES-256 with SHA-384.  This could
> theoretically enable someone using just that option to not even need
> SHA-256, and might also help avoid confusing compliance assessors.
> (NIST SP 800-107 has a discussion of hash strengths as used in various
> contexts :
> http://csrc.nist.gov/publications/nistpubs/800-107-rev1/sp800-107-rev1.pdf )

In terms of throughput, interestingly enough SHA2-512 is faster or
bulk data processing, because of its wider state, which means more
data is processed per step.  (Tested with OpenSSL 1.1 dev branch):

    $ openssl speed sha256
    type             16 bytes     64 bytes    256 bytes   1024 bytes   8192 bytes
    sha256           41170.10k    90881.05k   154050.73k   187984.90k   200602.63k

    $ openssl speed sha512
    type             16 bytes     64 bytes    256 bytes   1024 bytes   8192 bytes
    sha512           27398.45k   107324.81k   167345.58k   234789.84k   265300.65k

Similar gain reported at:

    https://en.wikipedia.org/wiki/SHA-2#Comparison_of_SHA_functions

So I guess there's no harm in using SHA2-384 even though SHA2-256
might do.  Of course the story may be different on 32-bit CPUs.

-- 
	Viktor.