Re: [TLS] draft-ietf-tls-cached-info-02 / New "Fast-Track" draft

[Brian Smith <[e-mail]>]

Stefan Santesson wrote:
> Brian,
>
> The use of hash functions in this draft does not require collision 
> resistance.
> This is actually quite easy to prove.
Nobody is questioning that at all.

My points are:

1. As long as this web page on the NIST website says, basically, "don't 
use SHA-1 for anything," people will want to disable SHA-1 whenever they 
can. It doesn't matter that this page on the website isn't the official 
NIST recommendation on the matter. It doesn't matter that NIST 
recommendations are only binding for federal government work. It doesn't 
matter that the official NIST recommendation (SP 800-107) is more 
limited in its recommendations against SHA-1. People will still want to 
disable it. Like I said many messages before, even if it isn't a  
technical problem, it is a social problem. And, that problem can be 
easily avoided.

2. It doesn't make sense to require SHA-1 support to be added to 
implementations that don't need SHA-1 for any other purpose. TLS 1.2 
doesn't require SHA-1 for anything, so you can build a compliant and 
useful implementation without SHA-1 support. There are technical 
advantages to doing so. Obviously, this isn't practical for 
general-purpose web browsers, but it is practical for many other uses.

3. There are two simple alternatives that work: (a) mandate SHA2 instead 
of SHA1, at least for TLS 1.2+, or (b) avoid mandating any hashing at 
all by using opaque tokens.

Cheers,
Brian