Re: [TLS] SHA-1 vs. FNV-1

[Eric Rescorla <[e-mail]>]

On Mon, May 10, 2010 at 10:09 AM, Blumenthal, Uri - 0668 - MITLL
<[e-mail]> wrote:
> On 5/10/10  12:58 , "Eric Rescorla" <[e-mail]> wrote:
>> On Mon, May 10, 2010 at 9:55 AM, Blumenthal, Uri - 0668 - MITLL
>> <[e-mail]> wrote:
>>> I see absolutely no need to justify use of non-crypto algorithms for
>>> non-crypto purposes. "It's faster" would be all I'd care to say on the
>>> subject.
>>
>> The requirement is to explain why this is a non-crypto purpose. That's
>> where the analysis comes in.
>
> If there's even a hint that the usage could relate to security mechanisms -
> doesn't it mean that SHA-1 MUST be forbidden, and at least SHA256 should be
> mandated instead?
>
> We seem to be juggling with this back and forth:

You misunderstand me. The argument for not using SHA-1 (apparently) is
that people feel the need to then explain why it's safe to use here. My
point is that this explanation needs to exist in any case and so we might
as well use the common hash, namely SHA-1.


> - either this is security-related - then SHA-1 is not suitable and MUST be
> replaced with a currently-approved SECURE hash algorithm such as SHA256, or

No, this isn't the case.


> - it is not security-related - then SHA-1 is too slow and SHOULD be replaced
> with a faster algorithm.

The claim that SHA-1 is too slow to hash a tiny piece of data which would need
to be hashed multiple times in the handshake computation doesn't strike
me as even remotely plausible.

-Ekr