Re: [TLS] SHA-1 vs. FNV-1

[Marsh Ray <[e-mail]>]

On 5/10/2010 11:41 AM, Eric Rescorla wrote:
> On Mon, May 10, 2010 at 9:35 AM, Marsh Ray <[e-mail]> wrote:
>>
>> So anybody insisting on SHA-1 should
>> justify the extra CPU usage over MD5, no?
> 
> No, that's not true. Again, SHA-1 is simply the default hash algorithm people
> use at this point. Other than that, MD5 would be fine, yes.

I don't agree that there is an obvious choice of hash algorithm right now:

http://csrc.nist.gov/groups/ST/hash/policy.html
"After 2010, Federal agencies may use SHA-1 only for the following
applications: hash-based message authentication codes (HMACs); key
derivation functions (KDFs); and random number generators (RNGs)."

> As for "insisting", I really don't know what you mean. I'm not "insisting"
> on SHA-1 any more than Stefan is "insisting" on FNV-1. This is an undecided
> question in the WG and I'm stating my opinion.

I didn't mean to imply anyone was insisting, just a rhetorical point.

> As I noted previously, that exact explanation will need to be present
> to justify the use of a non-cryptographic hash.

Perhaps, but neither does that support SHA-1.

More NIST policy says:
"Federal agencies should stop using SHA-1 for digital signatures,
digital time stamping and other applications that require collision
resistance as soon as practical, and must use the SHA-2 family of hash
functions for these applications after 2010."

I'm just imagining a situation where a seasoned software
developer/manager is having to explain to to some external auditor
lacking a CS degree that "the hash table bucket collisions which could
occur in this part of the code are not the same kind of thing as the
collisions being talked about in this protocol, really".

- Marsh