Re: [TLS] TLS 1.3 draft-07 sneak peek

[[e-mail] (Martin Rex)]

Peter Gutmann wrote:
> Martin Rex <[e-mail]> writes:
>> 
>> All prior protocol versions, including SSLv3, are using RSA signatures with a
>> 278-bit hash (a concatenation of sha1+md5), which is a reasonable and
>> conservative design.  
> 
> It's also a totally nonstandard design that's a perpetual headache to support
> when you're dealing with crypto devices and other things.  The move to a
> standard, widely-supported scheme should have been made ages ago, long before
> TLS 1.2.

My gripe with TLSv1.2 is about *NEWLY* mandating support for two known weak
signature schemes: md5WithRSAEncryption and sha1WithRSAEncryption,
schemes that are substantially weaker than what earlier versions
of TLS and even SSLv3 had been using.

TLSv1.2 (rfc5246) was published in August 2008

PKCS#1 v2.1 (rfc3447, Feb 2003) had been published >5 years earlier.

http://tools.ietf.org/html/rfc3447#appendix-A.2.4

already knows about these stronger RSA signature algorithms: 


      SHA-256          sha256WithRSAEncryption ::= {pkcs-1 11}
      SHA-384          sha384WithRSAEncryption ::= {pkcs-1 12}
      SHA-512          sha512WithRSAEncryption ::= {pkcs-1 13}

and TLSv1.2 mandates support for sha-256 for the TLSv1.2 PRF anyway.

and NIST SP 800-57 part1 rev 2 (08-Mar-2007) said the following
about digital signatures with SHA-1 (footnote 22 on page 64):

   22 SHA-1 has recently been demonstrated to provide less than 80 bits
      of security for digital signatures; at the publication of this
      Recommendation, the security strength against collisions is
      assessed at 69 bits. The use of SHA-1 is not recommended for the
      generation of digital signatures in new systems; new systems
      should use one of the larger hash functions. For the present time,
      SHA-1 is included here to reflect it's widespread use in existing
      systems, for which the reduced security strength may not be of
      great concern when only 80-bits of security are required.

and says on page 65:

  A minimum of eighty bits of security shall be provided until 2010.
  Between 2011 and 2030, a minimum of 112 bits of security shall be
  provided. Thereafter, at least 128 bits of security shall be provided.

so the originally planned the sunsetting(!) date for use of SHA-1 in digital
signatures was end-of-2010.  So it was a fairly crazy&irresponsible idea for
TLSv1.2 (rfc5246) to newly add sha1WithRSAEncryption and md5WithRSAEncryption
(rather than sha256WithRSAEncryption) as default and mandatory-to-implement
signature schemes to TLSv1.2 as replacement for a _stronger_ schemes in
prior protocol versions.


-Martin