Re: [TLS] Suite B compliance of TLS 1.2

Martin Rex <martin.rex@sap.com> writes:

> Eric Rescorla wrote:
>> 
>> Wan-Teh Chang <wtchang@redhat.com> writes:
>> > At the 2005 RSA Conference, the US National
>> > Security Agency (NSA) announced Suite B Crytography
>> > (http://www.nsa.gov/ia/industry/crypto_suite_b.cfm).
>> > This suite of cryptographic algorithms includes AES,
>> > ECDSA, ECDH, ECMQV, and SHA-256/SHA-384.
>> >
>> > I'm interested in the Suite B compliance of TLS 1.2.
>> > Simply put, it means the ability to do TLS 1.2 using
>> > only Suite B algorithms.
>> >
>> > The primary goal of TLS 1.2, to remove the protocol's
>> > dependency on the MD5 and SHA-1 digest algorithms, is
>> > in line with Suite B compliance.  I'd like to start
>> > the discussion by proposing additional goals:
>> > - merge in or reference RFC 4492
>
> AFAIK, the dependency on the combination of SHA-1 and MD5 is
> hardwired into the protection of the SSL handshake,
> and independent of the ciphersuite that is negotiated.

It is in 1.1, but not in 1.2.

> So in order to remove the dependency, one does not only need
> new TLS ciphersuite, but also a significant change in the
> handshake protocol (hashing of the handshake messages
> and the creation/verification of the finished message).

Yep. Those changes are already being made

> Hashing the handshakes messages with both, old and new hash
> algorithms and deciding later in the handshake which results
> go into creation/verification of the finished message when
> it has been determined/negotiated which algorithms to use
> should be doable, and just moderately more expensive.
>
>
> I'm slightly worried about the potential "market pressure"
> which this might cause.  I certainly don't mind adoption/offering
> of strong cryptographic protocols/technologies, but right
> now I do NOT consider TLS fundamentally broken or weak,
> and I would prefer if people focus on the acutal weaknesses
> within the technology, rather than replacing the
> (currently) strongest link in a weak chain with a much
> stronger one.

I'm sensitive to what you're saying and I have the same doubts.
On the other hand, I also worry about the attacks on MD5 and SHA-1
getting much worse and then having to explain why we didn't
do anything about it

-Ekr

_______________________________________________
TLS mailing list
TLS@lists.ietf.org
https://www1.ietf.org/mailman/listinfo/tls