Re: [TLS] SHA-3 in SignatureScheme

[Dave Garrett <[e-mail]>]

On Thursday, September 01, 2016 02:30:54 pm Scott Fluhrer (sfluhrer) wrote:
> > On Thursday, 1 September 2016 12:43:31 CEST Benjamin Kaduk wrote:
> > > On 09/01/2016 12:38 PM, Hubert Kario wrote:
> > > > The SHA-3 standard is already published and accepted[1], shouldn't
> > > > TLSv1.3 include signatures with those hashes then?
> > >
> > > Why does it need to be part of the core spec instead of a separate
> > document?
> > 
> > because: we also are adding RSA-PSS to TLSv1.2 in this document, I don't see
> > why it needs to be delayed. Finally, TLSv1.2 added SHA-2 just like that, it was
> > not tacked on later.
> 
> IIRC, SHA-2 was a special case; SHA-1 was demonstrated to be cryptographically weaker than expected and so we needed to have a secure alternative ASAP.
> 
> The SHA-3 is not like that; there's no evidence that suggests that SHA-2 is weak; the only incentive to implementing SHA-3 is "we'll, it is a standard, and so we might as well support it".

The reason I see is that we currently specify exactly one valid hash algorithm (in a variety of sizes). The precedent argument is good enough for me. I think adding it in this document is definitely worth considering. I don't want to wait until SHA-2 is considered weak to provide an alternative, if we can avoid it.


Dave