Re: [TLS] TLS1.3

[Yoav Nir <[e-mail]>]

On Feb 11, 2013, at 12:03 PM, "Lewis, Nick" <[e-mail]<mailto:[e-mail]>> wrote:


The reality of TLS though is that there are many MACs in everyday use that are not secure (based on hashes of 80bits or even 64 bits).
These are currently protected from attack by being behind strong (112bit or 128 bit) crypt.
The "usual" MAC algorithms for TLS are HMAC-MD5, HMAC-SHA-1 and HMAC-SHA-256 (HMAC-SHA-384 is also a possibility).
These all have MAC tags of at least 128 bits.

RFC 6066 standardises "truncated" MAC tags for TLS, but these are known to be dangerous when used in combination with TLS's variable length padding
(see the distinguishing attack in my Asiacrypt 2011 paper with Ristenpart and Shrimpton).
However, I was not aware of anyone actually using these truncated MAC tags, or any other short-output MAC algorithms in TLS.
Can you provide specific examples in support of your argument?

Sorry I meant to say "bits of security" (as in a birthday attack) rather than leave an impression of bit length
According to NIST HMAC-MD5 and HMAC-SHA-1 are vulnerable and should not be used hence forth
http://csrc.nist.gov/publications/nistpubs/800-131A/sp800-131A.pdf

That's using SHA-1 as a signature hash.  As for other uses (emphasis theirs):


SHA-1 for non-digital signature applications:

For all other hash function applications, the use of SHA-1 is acceptable. The other applications include HMAC, Key Derivation Functions (KDFs), Random Number Generation (RNGs and RBGs), and hash-only applications (e.g., hashing passwords and using SHA-1 to compute a checksum, such as the approved integrity technique specified in Section 4.6.1 of [FIPS 140-2]).