Re: Antwort: [TLS] TLS 1.2 MAC calculation

On Fri, Aug 03, 2007 at 12:25:03PM +0200, Axel.Heider@gi-de.com wrote:

>> I just want to make sure I'm reading the spec
>> correctly.  Is SHA-256 used only for the PRF
>> calculation and the MAC algorithm is still
>> whatever the cipher suite says?  Or is SHA-
>> 256 also used for MAC calculations?  I believe
>> the former, so MD5 could even still be used
>> with RC4 -- is this correct?

> My opinion is, that for compatibility reasons, 
> all defined cipher suits sould work as before. 
> The SHA-256 versions of any cipher suits should 
> get a new id. This would also make the 
> implementation easier if all SSL/TLS versions 
> are supported.

Compatibility isn't really an important issue here (we have explicit
version negotiation).  Ease of implementation is.  Luckily, appendices
B and C make it quite clear that SHA still means SHA-1, and that MD5
still means MD5.  There's really nothing wrong with this: This use of
HMAC is for ephemeral authentication only, so there's no reason to
force everyone to live with the overhead of SHA-256 or something.

The situation is quite different for hashes in the PRF.  The PRF is
essential for the long-term security of encryption, and the old PRF is
somewhat weird; replacing it makes a lot of sense.

Bodo

_______________________________________________
TLS mailing list
TLS@lists.ietf.org
https://www1.ietf.org/mailman/listinfo/tls