Re: [TLS] SHA-1 vs. FNV-1

["Blumenthal, Uri - 0668 - MITLL" <[e-mail]>]

Eric,

My apologies - I indeed misunderstood your argument. Yes an explanation
would be required in any case - I agree.

Honestly I still think that use of SHA-1 here is not justifiable.

My vote is for FNV. I'm OK with whatever brings the consensus.

Tnx!

On 5/10/10  13:15 , "Eric Rescorla" <[e-mail]> wrote:

> On Mon, May 10, 2010 at 10:09 AM, Blumenthal, Uri - 0668 - MITLL
> <[e-mail]> wrote:
>> On 5/10/10  12:58 , "Eric Rescorla" <[e-mail]> wrote:
>>> On Mon, May 10, 2010 at 9:55 AM, Blumenthal, Uri - 0668 - MITLL
>>> <[e-mail]> wrote:
>>>> I see absolutely no need to justify use of non-crypto algorithms for
>>>> non-crypto purposes. "It's faster" would be all I'd care to say on the
>>>> subject.
>>> 
>>> The requirement is to explain why this is a non-crypto purpose. That's
>>> where the analysis comes in.
>> 
>> If there's even a hint that the usage could relate to security mechanisms -
>> doesn't it mean that SHA-1 MUST be forbidden, and at least SHA256 should be
>> mandated instead?
>> 
>> We seem to be juggling with this back and forth:
> 
> You misunderstand me. The argument for not using SHA-1 (apparently) is
> that people feel the need to then explain why it's safe to use here. My
> point is that this explanation needs to exist in any case and so we might
> as well use the common hash, namely SHA-1.
> 
> 
>> - either this is security-related - then SHA-1 is not suitable and MUST be
>> replaced with a currently-approved SECURE hash algorithm such as SHA256, or
> 
> No, this isn't the case.
> 
> 
>> - it is not security-related - then SHA-1 is too slow and SHOULD be replaced
>> with a faster algorithm.
> 
> The claim that SHA-1 is too slow to hash a tiny piece of data which would need
> to be hashed multiple times in the handshake computation doesn't strike
> me as even remotely plausible.
> 
> -Ekr

-- 
Regards,
Uri