Re: [TLS] Consensus Call: FNV vs SHA1

[Nicolas Williams <[e-mail]>]

On Tue, May 11, 2010 at 01:14:43PM -0400, Blumenthal, Uri - 0668 - MITLL wrote:
> If you're talking about Birthday Paradox - then just figure out how
> many bits of hash suffice to minimize the risk to acceptable level.

Yes.

> If you're talking about Birthday Paradox ATTACK - you're in the Crypto
> realm, and say "welcome" to SHA256 (which you probably already have in
> your code :-). And don't forget algorithm agility.

Well, there's an attack, yes, but it's a _DoS_ attack, and so not really
one we should be too concerned with.  However, if the DoS were
particularly difficult to recover then it'd be a DoS we'd want to
protect against by using a stronger cryptographic hash.  I think this
failure mode will be obnoxious, but not so obnoxious as to require that
we go to SHA-256.

Nico
--