Re: [TLS] Deployment ... Re: This working group has failed

[Marsh Ray <[e-mail]>]

From: TLS [mailto:[e-mail]] On Behalf Of Martin Rex
> 
> Resent (with correction) Sorry, I seem to be tired.
> 
> The TLSv1.1 PRF should be OK for 128-bit security strength.

TLS 1.1 https://tools.ietf.org/html/rfc4346#page-13
"   TLS's PRF is created by splitting the secret into two halves and
   using one half to generate data with P_MD5 and the other half to
   generate data with P_SHA-1, then exclusive-ORing the outputs of these
   two expansion functions together."

Good for 160 bits I figure?

TLS 1.2  https://tools.ietf.org/html/rfc5246#page-14
"   In this section, we define one PRF, based on HMAC.  This PRF with the
   SHA-256 hash function is used for all cipher suites defined in this
   document and in TLS documents published prior to this document when
   TLS 1.2 is negotiated.  New cipher suites MUST explicitly specify a
   PRF and, in general, SHOULD use the TLS PRF with SHA-256 or a
   stronger standard hash function.
"
Sounds stronger to me.

> The weakness of TLSv1.2 is in the RSA signatures (digitally signed).
> SSLv3, TLSv1.0 and TLSv1.1 were using an SHA1+MD5 combination for digitally
> signed, which is stronger than SHA1 alone.
> 
> TLSv1.2 substituted this with either (RSA,sha1) or (RSA,md5), and the latter is
> pretty far from 128-bit security.

But if the attacker can break MD5, he can exploit an MD5 cert chain, right? (e.g., Flamer)
If not, he can't negotiate the use of MD5 for signing the TLS handshake.

If the attacker can break SHA-1, he can exploit a SHA-1 trusted root, right?
If not, he can't negotiate the use of SHA-1 for signing the TLS handshake.

So TLS 1.2 just follows the convention established by the available trusted root CA. No configuration that could be stronger than SHA-1 can be weakened to SHA-1. Furthermore, no configuration that could be stronger than SHA-1+MD5 can be weakened to SHA-1+MD5.

Or am I missing something?

Are you saying that TLS 1.2 clients in practice MUST send md5 and sha1 in supported_signature_algorithms, even if they trust no MD5 or SHA-1 roots?

- Marsh