Re: [TLS] Results of interim meeting

[Andy Lutomirski <[e-mail]>]

On 05/26/2014 09:34 AM, Watson Ladd wrote:
> Dear all,
> 
> It looks like most of the slides were devoted to SNI, and it is not
> clear what was actually decided.
> 
> I haven't seen any slides about Triple Handshake, despite being on the
> interim agenda. Is this a sign that the proposed fix for TLS 1.2 is
> acceptable?

There was a concern that the proposed fix might allow the client to
construct two different ClientHellos that would nonetheless result in
the same tls-unique value using the pre-TLS-1.2 PRFs.  The issue is
that, if you could find a SHA-1 collision, then MD5 is short enough that
it could be possible to do a length-extension attack and brute-force it
to be an MD5 collision as well.

No one present knew whether this mattered.

--Andy