Re: [TLS] Suite B compliance of TLS 1.2

Wan-Teh Chang wrote:
> Eric Rescorla wrote:
> 
>> I'm not that familiar with Suite B, but if it, as you
>> say, it doesn't include a MAC algorithm, I'm not sure
>> what you're suggesting for message integrity.
> 
> I'm not a cryptographer, so I am struggling with these
> questions.
> 
> Option 1: investigate whether HMAC-SHA-1 is still secure
> and consider HMAC-SHA-256 and HMAC-SHA-384.
> 
> In NIST Special Publication (SP) 800-57 Part 1
> (http://csrc.nist.gov/publications/nistpubs/800-57/SP800-57-Part1.pdf)
> Table 3 (in Section 5.6.1 on page 64) lists the security
> strengths of HMAC with various hash functions.  It shows
> that HMAC-SHA-1 may only be used for <= 128 bits of security,
> and HMAC-SHA-256 may be used for <= 256 bits of security.

As pointed out in the Security Considerations for the truncated_hmac
option in RFC 4366:

   Note that the output length of a MAC need not be as long as the
   length of a symmetric cipher key, since forging of MAC values cannot
   be done off-line: in TLS, a single failed MAC guess will cause the
   immediate termination of the TLS session.

As a result, HMAC is not a weak point in TLS for any ciphersuite.

-- 
David Hopwood <david.nospam.hopwood@blueyonder.co.uk>

_______________________________________________
TLS mailing list
TLS@lists.ietf.org
https://www1.ietf.org/mailman/listinfo/tls