Re: [TLS] draft-turner-ssl-must-not

[Martin Rex <[e-mail]>]

Marsh Ray wrote:
> 
> On Tue, Jul 06, 2010 at 04:17:14AM +0200, Martin Rex wrote:
> > 
> > The base result is that the strength of concatenation of two
> > hash functions improves the result not as much as one might hope.
> > 
> > It always does improve the result, however.
> 
> Putting it another way, if you spend 36 bytes (288 bits) on space
> for your hash and it turns out to have only about 2^75 collision
> resistance, I'm not sure many people would call that an improvement.

It is an improvement because it is harder to find a collision
for both hashes than finding it for only one of them.  And it used
the commonly available cryptographic hashes at that time
(sha-2 was not available back then).

I see it as an improvement, even if it is a small one.


> 
> > Which means that SSLv3 is stronger than TLSv1.0 and TLSv1.1
> > in that respect.
> > 
> > Personally, I dislike the extreme truncation of the Finished
> > messages in TLS to 12 octets. My expectation is that this limits
> > the overall strength, and that it spoils the use of SHA-2 in TLSv1.2.
> 
> +1.
> 
> There's no logic to it, or whatever there might be is too clever by half.

There appears to be a lack of logic by not adjusting the truncation size
when going from a SHA-1 (=160 bits) based PRF to a SHA-256 (=256 bits)
based PRF.  In case a 96 bit truncation is deemed adequate for SHA-1,
then a truncation like 144 or 160 bits appears more appropriate for SHA-2.

-Martin