Re: [TLS] Collisions (Re: Nico's suggestions - Re: Consensus Call:

[Marsh Ray <[e-mail]>]

On 5/12/2010 4:30 AM, Simon Josefsson wrote:
> Marsh Ray <[e-mail]> writes:
> 
>> Alternatively, if we determine that indeed the non-collision-resistance
>> of the hash function is the root of all remaining concerns that would be
>> very positive. We could solve them all in one stroke with
>> s/FNV-1a/SHA-256/g.
> 
> If collision-resistance is a required property (I'm not convinced yet),
> I believe we need hash agility for the possibility that SHA-256 is weak.

But perhaps that agility already exists in the form of the protocol
version negotiation.

TLS 1.2 appears to effectively depend on SHA-256 (at least in HMAC form)
for the PRF. If that gets broken, we can probably not trust anything
else negotiated in the handshake and a rev of the base protocol will be
required to fix it anyway.

If bare SHA-256 is a concern, the hash could be defined as something
like hmac_sha256("Cached Info", object_bytes).

Just a thought.

- Marsh