Re: [TLS] New cached-info draft 09 posted

[Simon Josefsson <[e-mail]>]

Marsh Ray <[e-mail]> writes:

> On 07/13/2010 11:07 AM, Stefan Santesson wrote:
>> How about MUST use SHA-1 for TLS<1.2 and the proposed solution for =<
>> 1.2?
>
> Does it meet the requirements? What were the requirements again?

That is a very good question.  Did we establish that FNV is not good
enough?  Could we add a succinct writeup of the requirements to the
document?  I'm not sure I recall what the long discussions resulted in
any more..  It is difficult to know whether SHA-1 is good enough if we
don't know what it should be good enough for.

/Simon

> Does it need collision resistance?
> If so, SHA-1 is deprecated:
> http://csrc.nist.gov/groups/ST/hash/policy.html
>> Federal agencies should stop using SHA-1 for digital signatures,
>> digital time stamping and other applications that require collision
>> resistance as soon as practical, and must use the SHA-2 family of
>> hash functions for these applications after 2010.
>
> If it doesn't need collision resistance, does it need preimage resistance?
> If not, FNV is the way to go.
> If so, SHA-1 probably works but it is certainly going out of style. If
> you're going to pick a hash function, SHA-256 might be a better
> choice.
>
> Sorry to be such a curmudeon, but it seems like if we're going to use
> some bit string as a proxy for an object in the handshake I think the
> default assumption needs be that it must not weaken the Finished
> computation. If it wasn't important, we could have used FNV. But we
> decided it was too security critical for FNV, if not for the object
> types defined now, perhaps for other object types that will be defined
> in the future.
>
> I don't think the "it needs to be secure but not that secure, so we
> need more than X but less than Z how about Y" is a good method of
> selecting the hash. If folks feel this usage doesn't require 24 bytes
> out of the PRF like the Finished messages it would be good for someone
> to post just a little bit of quantitative justification. (E.g.,
> ...therefore it needs x bits of resistance to ...)
>
> - Marsh