Re: [TLS] Consensus Call: FNV vs SHA1

[Simon Josefsson <[e-mail]>]

Nicolas Williams <[e-mail]> writes:

>  - Add a description of what happens if cached object checksums collide.
>
>    No, the current security considerations section doesn't deal with
>    this, and rightly so _if_ collisions are not a security problem, but
>    what happens when there are collisions?  Do hanshakes fail?

I agree that it is important to explain this.

If collisions happen, it appears that we do get slightly weaker
semantics of what it means for a handshake to succeed: we aren't
cryptographically certain (in the sense that there is cryptographic
reduction) that the client and server agree on the data used during the
handshake for cached items (CA cert list, server certificate) after the
handshake has concluded.

It seems a server could easily create two pairs of server certificates
that results in the same FNV-1a value but are different certificates.  A
client connecting to a server offering a cached value for the server
certificate would not know which server certificate was intended, even
after completing the handshake.  If correct, that seems surprising.

This requires a conspiring server, so maybe it is irrelevant.

This problem would be solved if the Finished message were computed over
the replaced data rather than the digest value.  Then any data
mismatches would be detected at the TLS Finished computation, and the
handshake fail.  Perhaps this is simpler than introducing a
cryptographic digest.

It is late here, so I may be totally missing some aspect.

/Simon