Re: [TLS] Curve25519 and TLS

You are correct. But the underlying hash must be a PRF for the proofs to hold.

--
Regards,
Uri Blumenthal                            Voice: (781) 981-1638
Cyber Systems and Technology   Fax:   (781) 981-0186
MIT Lincoln Laboratory                Cell:  (339) 223-5363
244 Wood Street                        Email: <uri@ll.mit.edu>
Lexington, MA  02420-9185       

Web:  http://www.ll.mit.edu/CST/

MIT LL Root CA: 

 <https://www.ll.mit.edu/labcertificateauthority.html>

DSN:   478-5980 ask Lincoln ext.1638

----- Original Message -----
From: Paul Hoffman [mailto:paul.hoffman@vpnc.org]
Sent: Monday, June 23, 2014 02:36 AM
To: tls@ietf.org <tls@ietf.org>
Subject: Re: [TLS] Curve25519 and TLS

On Jun 23, 2014, at 2:24 AM, Watson Ladd <watsonbladd@gmail.com> wrote:

>>> Why wouldn't it be? If H(m)=H(m'), that's just as much a collision as
>>> if H(m || stuff)=H(m' || stuff).
>> 
>> 
>> Well, this isn't quite the two cases we are considering, since we are
>> computing either:
>> 
>> HMAC(Key, stuff)
>> 
>> or:
>> 
>> HMAC(Key, H(stuff))
>> 
>> with:
>> - stuff being under partial control of the attacker and
>> - the Key being subject to the issue you raise in the message
>> that started this thread.
> 
> HMAC is H(key || H(stuff)) right? So it turns into H(key || H(stuff))
> vs H(key || H(H(stuff))). (Yes, there is padding: that's an injective
> function, so doesn't matter for this analysis). Once again a collision
> means stuff equals stuff both ways.

Bellare showed that weakening of the collision resistance in the underlying hash doesn't matter, right? <http://cseweb.ucsd.edu/~mihir/papers/hmac-new.html>? I haven't seen any refutation or weakening of that paper, but I could have missed it.

--Paul Hoffman
_______________________________________________
TLS mailing list
TLS@ietf.org
https://www.ietf.org/mailman/listinfo/tls