Re: [TLS] FNV versus SHA-1 in cached info

[Nicolas Williams <[e-mail]>]

On Fri, May 07, 2010 at 09:58:24PM +0200, Stefan Santesson wrote:
> Let me remind that we started off with SHA-1 with no agility.
> 
> That kicked off a lot of debate whether agility was required and the general
> opinion was that we needed agility, so agility was added.

Your use is not for cryptographic purposes, therefore you don't need
hash agility.

In GS2, for example, we use a hash function to derive SASL mechanism
names from GSS-API mechanism OIDs.  We don't care about collisions, and
there are no attacks on hash functions that result in attacks on GS2
from this use of hashing.  Hash agility in the GS2 case would be worse
than stupid: changing hash functions would break applications.

The answer to "where's the hash agility?" is "we don't need it because
we're not using SHA-1 for its cryptographic properties".

By accepting that "hash agility" goes with "cryptographic hash function"
even when you don't ndeed nor depend on its cryptographic properties
you've simply caused yourself to do a sizeable amount of pointless work
(FNV).  And not just you, but also implementors (yeah, if they use one
of the languages for which you include implementations then they can
cut-n-paste from your document, after getting approval from their
lawyers).  Why do this to yourself and to the rest of us when there's a
much better answer?

Nico
--