[TLS] HMAC vs HASH

[Michael StJohns <[e-mail]>]

Hi -

Slightly different topic from before.

The signature over the finished messages is TLS-PRF(HASH (handshake 
messages)).

My question - assuming the HASH and TLS-PRF both use SHA256 - what is 
the security strength of that signature function?

I note that back in the archive that Marsh Ray from Microsoft took a 
swing at this 
(https://www.ietf.org/mail-archive/web/tls/current/msg10584.html) and 
concluded it wasn't an issue, but he was looking at it from the 
viewpoint of recovery of the HMAC key, but I'm not sure this is the 
worst case viewpoint.

As I read the guidance, HMAC-SHA256 is 256 bit secure, but SHA256 is 
only 128 bit secure with respect to signatures.

If that's the case, is the handshake finished message signature security 
any stronger than the signature strength of the hash function?  E.g. 128 
bits for a SHA256 hash?

Note that I'm not having a discussion about whether or not 128 bits is 
sufficient, but whether or not SHA256 as the summary hash function 
represents the weakest part of the cipher suite for suites with bit 
strengths above 128 bits.

Mike