Re: [TLS] draft-ietf-tls-cached-info-02 / New "Fast-Track" draft

[Simon Josefsson <[e-mail]>]

Brian Smith <[e-mail]> writes:

> 1. As long as this web page on the NIST website says, basically,
> "don't use SHA-1 for anything," people will want to disable SHA-1
> whenever they can. It doesn't matter that this page on the website
> isn't the official NIST recommendation on the matter.

I'd like to suggest another argument to support your reasoning: some
FIPS approved crypto libraries no longer export MD5.  I expect the same
to be true for SHA-1 within a few years.  This means that SHA-1 will no
longer be as easily available, for these non-crypto purposes needed in
tls-cached-info.

We noticed this in GnuTLS, that needs MD5 for older TLS versions.  Our
"solution" was to add an optional MD5 implementation to GnuTLS, rather
than always depending on the crypto library for MD5.  This felt strange
to do, but is the logical consequence of deprecating MD5, and eventually
SHA-1, as supported algorithms.

Chosing SHA-256 will give us more time, but we'll likely run into the
same issue eventually anyway.  I believe this suggests that algorithm
agility is useful whenever any crypto-related algorithm is _used_, even
if it is used for non-crypto related purposes.

/Simon