Re: [TLS] New cached-info draft 09 posted

[Stefan Santesson <[e-mail]>]

Seems like we will never dig us out of this worm hole :)

I have to admit that I just learned some new stuff. The idea was to not
degrade the security properties of the finished message. I was under the
impression that we would not do that for TLS <1.2 if we use SHA-1.

I guess we are back to square 1.

I'm currently on vacation and may have to rest my case until the meeting in
Maastricht.

/Stefan



On 10-07-13 6:54 PM, "Marsh Ray" <[e-mail]> wrote:

> On 07/13/2010 11:07 AM, Stefan Santesson wrote:
>> How about MUST use SHA-1 for TLS<1.2 and the proposed solution for =<
>> 1.2?
> 
> Does it meet the requirements? What were the requirements again?
> 
> Does it need collision resistance?
> If so, SHA-1 is deprecated:
> http://csrc.nist.gov/groups/ST/hash/policy.html
>> Federal agencies should stop using SHA-1 for digital signatures,
>> digital time stamping and other applications that require collision
>> resistance as soon as practical, and must use the SHA-2 family of
>> hash functions for these applications after 2010.
> 
> If it doesn't need collision resistance, does it need preimage resistance?
> If not, FNV is the way to go.
> If so, SHA-1 probably works but it is certainly going out of style. If
> you're going to pick a hash function, SHA-256 might be a better choice.
> 
> Sorry to be such a curmudeon, but it seems like if we're going to use
> some bit string as a proxy for an object in the handshake I think the
> default assumption needs be that it must not weaken the Finished
> computation. If it wasn't important, we could have used FNV. But we
> decided it was too security critical for FNV, if not for the object
> types defined now, perhaps for other object types that will be defined
> in the future.
> 
> I don't think the "it needs to be secure but not that secure, so we need
> more than X but less than Z how about Y" is a good method of selecting
> the hash. If folks feel this usage doesn't require 24 bytes out of the
> PRF like the Finished messages it would be good for someone to post just
> a little bit of quantitative justification. (E.g., ...therefore it needs
> x bits of resistance to ...)
> 
> - Marsh