Re: [TLS] draft-turner-ssl-must-not

[Simon Josefsson <[e-mail]>]

Marsh Ray <[e-mail]> writes:

> On 07/06/2010 12:17 PM, Blumenthal, Uri - 0668 - MITLL wrote:
>> There are two attacks: (a) finding collisions, and (b) offline
>> guessing/brute-forcing the key. The fewer bits of the complete hash you have
>> - the less ability to verify&  disambiguate your guess.
>>
>> The balance is between outputting enough bits to defeat collision-based
>> attacks, yet omitting enough bits to prevent disambiguating the key in
>> offline trials.
>
> My impression was that preventing the occurrence of known plaintext
> was no longer considered an important design principle.
>
> Even if the Finished message were made very short, it's probable that
> there will be plenty of known plaintext in record headers, padding
> bytes, not to mention the application data itself. Any text based is
> going to have a zero high bit on a great majority of chars,
> compression is far from standard and it presumably brings its own
> known headers.
>
> So, from what I hear, modern ciphers are expected to be resistant to
> known plaintext attacks.

TLS has integrity-only ciphersuites that does not provide
confidentiality, making the TLS Finished message visible to attackers.
But I don't follow the logic here and want to challenge you with a
question: what attack is enabled if an attacker can find a collision?
It may help to consider what attacks are enabled if the TLS Finished
messages is truncated to, say, 10 bits instead.

/Simon