Re: [TLS] FNV versus SHA-1 in cached info

["Blumenthal, Uri - 0668 - MITLL" <[e-mail]>]

For cryptographic purposes agility is critical, and it's obvious.

For non-cryptographic purposes - who cares. Let the implementers figure what
works best and "codify" it. If it's SHA - fine. If it's FNV - fine. If it's
MD4 - fine. No sense avoiding cryptographically broken algorithms for
non-cryptographic use.


On 5/7/10  12:26 , "Nicolas Williams" <[e-mail]> wrote:

> On Fri, May 07, 2010 at 01:24:18PM +0200, Simon Josefsson wrote:
>> Stefan Santesson <[e-mail]> writes:
>>> I would not have any problem with using SHA-1 if it could be used with no
>>> agility what so ever. But I seriously doubt that this will be accepted and
>>> for that reason I would like to keep FNV.
> 
> It's been accepted elsewhere.  If cryptographic properties are not
> required then algorithm agility is also not required.
> 
>> I also prefer to use FNV here.
> 
> I am of two minds about this issue.
> 
>> Organizations are performing review of how MD5 and eventually SHA-1 are
>> used in their code bases, and this is costly.
> 
> This is true, however, you'd think that we should all also audit our
> code bases and protocols (proprietary and otherwise) to ensure that we
> do use strong cryptographic algorithms where we _need_ them, that we
> have migration plans, and that we execute them.  Just removing uses of
> MD5 and SHA-1 will not do.
> 
> I'm concerned that a blanket "must not use MD5 nor SHA-1" rule will be
> counter-productive for _proprietary_ protocols: developers might resort
> to home-grown non-cryptographic hashes where they need cryptographic
> ones, just to avoid unwelcome auditor attention.  Clearly that won't
> happen for Internet protocols -not much- but there's a bigger world out
> there, and training management to just ban weak algorithms might well
> have unintended and very negative consequences.
> 
> Thus I'm not too sympathetic to arguments that we should refrain from
> using MD5/SHA-1 where cryptographic properties are not needed.  I'd
> rather train auditors to analyze protocols correctly than to apply
> reflexive dicta.
> 
> But I've also seen the pressure to avoid using MD5/SHA-1 altogether, and
> understand that often it's just easier to give.
> 
>>                                                If we know when designing
>> a protocol that the normal cryptographic properties are not essential,
>> and that an algorithm like FNV will suffice, it saves everyone the costs
>> associated with that review.  [...]
> 
> Does it?  We still have to review whether cryptographic properties were
> or were not necessary.
> 
>> I wish we used something like FNV instead of SHA-1 in SASL GS2, the use
>> there also do not require cryptographic properties.
> 
> Quick, we're still in AUTH48!  (Just kidding.)
> 
> Nico

-- 
Regards,
Uri         [e-mail]
<Disclaimer>