Re: [TLS] Wrapping up cached info

[Marsh Ray <[e-mail]>]

On 5/17/2010 10:33 AM, Blumenthal, Uri - 0668 - MITLL wrote:
> Stefan,
> 
> There is one problem.
> 
> If it turns out that you need SHA256 for security reasons - then you'll also
> need algorithm agility because nobody can guarantee that SHA256 will hold
> (remember - MD4, MD5, SHA1...? :-).
>

At some point, you have to trust something. After all, any capability
negotiated in the handshake is only as good as the hash which covers it.
TLS 1.2 seems to trust hmac_SHA256.

If, worst-case, SHA-256 turns out to be completely broken, the world
could switch to a stronger scheme for generating those 256 bits
relatively easily.

> Also, do you care how many bits the hash outputs, and how many of
> those bits you use?

I think that's probably the more important thing to fix in the spec.
It's probably a bit easier (should the unfortunate need arise) for
existing implementations to use a different hash of the same width than
it is to change the width of protocol elements.

> Let's provide the analysis and hope that it shows no security issues here.

We don't have to use SHA-256, but it sounds to me like the easiest
choice to explain (and thus get agreement on).

A quick glance at Wikipedia
http://en.wikipedia.org/wiki/Comparison_of_cryptographic_hash_functions
lists the only attack against SHA-256 to be against an egregiously
weakened (24 instead of 64 rounds) variant.

- Marsh