Re: [TLS] Collisions (Re: Nico's suggestions - Re: Consensus Call:

["Brian Smith" <[e-mail]>]

Simon Josefsson wrote:
> Marsh Ray <[e-mail]> writes:
> 
> > Alternatively, if we determine that indeed the
> > non-collision-resistance of the hash function is the root of all
> > remaining concerns that would be very positive. We could solve them
> > all in one stroke with s/FNV-1a/SHA-256/g.
> 
> If collision-resistance is a required property (I'm not convinced yet), I
believe we
> need hash agility for the possibility that SHA-256 is weak.

In that case, it would be better to consider a new design that follows the
session ID / server-public-key-id design, where the server provides a
cryptographically secured (by TLS) opaque identifier (format totally
unspecified) for the cached data that the client can then use in subsequent
connections. 

Somebody earlier in this thread made a good point that you rarely need this
caching extension if you make good use of session resumption. I think it may
be much better to consider extensions to session resumption that make it
safe(r) to keep sessions open indefinitely (many weeks/months/years).
Perhaps we just need a new extension that says "use this ticket to create a
session using the same server certificate and/or client cert CA list that
was used when the session ticket was created."

Regards,
Brian