RE: [TLS] Suite B compliance of TLS 1.2

>> So in order to remove the dependency, one does not only need
>> new TLS ciphersuite, but also a significant change in the
>> handshake protocol (hashing of the handshake messages
>> and the creation/verification of the finished message).
>
>Yep. Those changes are already being made

:-)

>> Hashing the handshakes messages with both, old and new hash
>> algorithms and deciding later in the handshake which results
>> go into creation/verification of the finished message when
>> it has been determined/negotiated which algorithms to use
>> should be doable, and just moderately more expensive.

I think the preferred direction is to hash with the new negotiated hash.
What would be the purpose of hashing with the old one?

>> I'm slightly worried about the potential "market pressure"
>> which this might cause.  I certainly don't mind adoption/offering
>> of strong cryptographic protocols/technologies, but right
>> now I do NOT consider TLS fundamentally broken or weak,
>> and I would prefer if people focus on the acutal weaknesses
>> within the technology, rather than replacing the
>> (currently) strongest link in a weak chain with a much
>> stronger one.
>
>I'm sensitive to what you're saying and I have the same doubts.
>On the other hand, I also worry about the attacks on MD5 and SHA-1
>getting much worse and then having to explain why we didn't
>do anything about it

Exactly. 

But I'm confused wrt. what Martin calls "strongest link". Clearly it's
not RSA or SHA-1 (and hopefully not MD5 :-)?

_______________________________________________
TLS mailing list
TLS@lists.ietf.org
https://www1.ietf.org/mailman/listinfo/tls