Re: [TLS] TLS 1.3 draft-07 sneak peek

[[e-mail] (Martin Rex)]

Quynh Dang wrote:
>
> The ineffectiveness issue of cascading hashes has been widely known for a
> long time ago.

Are you thinking of research like this:

http://www.iacr.org/cryptodb/archive/2004/CRYPTO/1472/1472.pdf


> 
> Therefore, finding collisions for SHA1 and collisions for SHA1 || MD5
> require about the same computational complexity.


I'm not a cryptographer.  I have just found the above paper with google
and just skimmed over it, and it looks a little misleading to me.


Collision attacks and preimage attacks are not the same.
finding a practial collision attack will not give you an
equivalent practical preimage attack for free.
Practical collision attacks against MD5 have been demonstrated.
Did I miss the publication of a practical MD5 preimage attack?


The reason why I prefer the conservative design of the concatenated
hashes is _not_ because their security adds up as if it were a
single hash algorithm of the combined bitsize (because it doesn't),
but because the attacks against individual algorithms will not add up
as if it was a single algorithm (because it isn't). 


-Martin