Re: [TLS] Curve25519 and TLS

On Sun, Jun 22, 2014 at 11:36 PM, Paul Hoffman <paul.hoffman@vpnc.org> wrote:
> On Jun 23, 2014, at 2:24 AM, Watson Ladd <watsonbladd@gmail.com> wrote:
>
>>>> Why wouldn't it be? If H(m)=H(m'), that's just as much a collision as
>>>> if H(m || stuff)=H(m' || stuff).
>>>
>>>
>>> Well, this isn't quite the two cases we are considering, since we are
>>> computing either:
>>>
>>> HMAC(Key, stuff)
>>>
>>> or:
>>>
>>> HMAC(Key, H(stuff))
>>>
>>> with:
>>> - stuff being under partial control of the attacker and
>>> - the Key being subject to the issue you raise in the message
>>> that started this thread.
>>
>> HMAC is H(key || H(stuff)) right? So it turns into H(key || H(stuff))
>> vs H(key || H(H(stuff))). (Yes, there is padding: that's an injective
>> function, so doesn't matter for this analysis). Once again a collision
>> means stuff equals stuff both ways.
>
> Bellare showed that weakening of the collision resistance in the underlying hash doesn't matter, right? <http://cseweb.ucsd.edu/~mihir/papers/hmac-new.html>? I haven't seen any refutation or weakening of that paper, but I could have missed it.

But here the key is known to the attacker (because it was the result
of a DH operation on a point of small order) : that paper is
completely irrelevant.

Furthermore, all TLS implementations somehow validate signatures: we
can use the collision resistant hash from that and avoid having to
think about these issues.

Sincerely,
Watson Ladd

>
> --Paul Hoffman
> _______________________________________________
> TLS mailing list
> TLS@ietf.org
> https://www.ietf.org/mailman/listinfo/tls

-- 
"Those who would give up Essential Liberty to purchase a little
Temporary Safety deserve neither  Liberty nor Safety."
-- Benjamin Franklin