Re: [TLS] TLS1.3

A naive attack to find collisions in SHA-1 would require hashing 2^80 buffers. Another way of saying this is that is has 80-bit strength in collision resistance. In fact it's weaker than that, because there are more efficient attacks.

However, having a 2^80 or 2^64 collision attack does not make it any easier to find a second pre-image or to break HMAC-SHA-1. The HMAC construction is specifically aimed at preventing collision weakness from affecting MAC strength. You can read about this in section 6 of RFC 2104 or the references from there. 

Hope this helps

Yoav

On Feb 11, 2013, at 12:48 PM, "Lewis, Nick" <nick.lewis@usa.g4s.com>
 wrote:

> Uh? Can some one help me here?
> SHA-1 has 80 bit of security according to B.2 and according to Table 9 an HMAC of 80 bits cannot be used but elsewhere the NIST document states that HMAC-SHA1 is acceptable
> 
> -- Nick
> 
> The details of this company are as follows:
> G4S Technology Limited, Registered Office: Challenge House, International Drive, Tewkesbury, Gloucestershire GL20 8UQ, Registered in England No. 2382338.
> 
> This communication may contain information which is confidential, personal and/or privileged.
> 
> It is for the exclusive use of the intended recipient(s).
> If you are not the intended recipient(s), please note that any distribution, forwarding, copying or use of this communication or the information in it is strictly prohibited.
> 
> Any personal views expressed in this e-mail are those of the individual sender and the company does not endorse or accept responsibility for them.
> 
> Prior to taking any action based upon this e-mail message, you should seek appropriate confirmation of its authenticity.
> 
> This e-mail has been scanned for all viruses by MessageLabs.
> _______________________________________________
> TLS mailing list
> TLS@ietf.org
> https://www.ietf.org/mailman/listinfo/tls
> 
> Email secured by Check Point