Re: [TLS] TLS1.3

["Paterson, Kenny" <[e-mail]>]

Nick,

I think you've mis-read the NIST document.

SHA-1 is still "acceptable" for applications not related to digital signature generation (see Table 9). That includes MACing - see HMAC entry, Table 10, and the ensuing text:

"HMAC Generation: Any approved hash function may be used.
The use of key lengths ≥ 80 bits, but < 112 bits is acceptable through December 31, 2010.
From January 1, 2011 through December 31, 2013, the use of key lengths ≥ 80 bits, but < 112 bits is deprecated.
After December 31, 2013, key lengths < 112 bits shall not be used.
The use of key lengths ≥ 112 bits is acceptable."

For the definition of acceptable, the document says:

"Acceptable is used to mean that the algorithm and key length is safe to use; no security risk is currently known."

Regards,

Kenny


On 11 Feb 2013, at 10:03, Lewis, Nick wrote:


The reality of TLS though is that there are many MACs in everyday use that are not secure (based on hashes of 80bits or even 64 bits).
These are currently protected from attack by being behind strong (112bit or 128 bit) crypt.
The "usual" MAC algorithms for TLS are HMAC-MD5, HMAC-SHA-1 and HMAC-SHA-256 (HMAC-SHA-384 is also a possibility).
These all have MAC tags of at least 128 bits.

RFC 6066 standardises "truncated" MAC tags for TLS, but these are known to be dangerous when used in combination with TLS's variable length padding
(see the distinguishing attack in my Asiacrypt 2011 paper with Ristenpart and Shrimpton).
However, I was not aware of anyone actually using these truncated MAC tags, or any other short-output MAC algorithms in TLS.
Can you provide specific examples in support of your argument?

Sorry I meant to say "bits of security" (as in a birthday attack) rather than leave an impression of bit length
According to NIST HMAC-MD5 and HMAC-SHA-1 are vulnerable and should not be used hence forth
http://csrc.nist.gov/publications/nistpubs/800-131A/sp800-131A.pdf

-- Nick



The details of this company are as follows:
G4S Technology Limited, Registered Office: Challenge House, International Drive, Tewkesbury, Gloucestershire GL20 8UQ, Registered in England No. 2382338.

This communication may contain information which is confidential, personal and/or privileged.

It is for the exclusive use of the intended recipient(s).
If you are not the intended recipient(s), please note that any distribution, forwarding, copying or use of this communication or the information in it is strictly prohibited.

Any personal views expressed in this e-mail are those of the individual sender and the company does not endorse or accept responsibility for them.

Prior to taking any action based upon this e-mail message, you should seek appropriate confirmation of its authenticity.

This e-mail has been scanned for all viruses by MessageLabs.