Re: [TLS] SHA-2 in TLS 1.0 and 1.1 -- Was: Remarks on draft-popov-prohibiting-rc4-01

[[e-mail] (Martin Rex)]

Manuel Pégourié-Gonnard wrote:
>
> Watson Ladd wrote:
>>
>> Even if SHA-1 is utterly broken, this won't necessarily break HMAC
>> based on it.

More importantly, with the current TLS protocol, the MAC is encrypted,
so even if SHA-1 was "broken" and HMAC-SHA1 was broken too, the
MAC would still be encrypted and therefore still be more secure than
AES-GCM ciphersuites.  (The GHASH function that is used by AES-GCM
does not have cryptographic properties to begin with).


>> 
>> I also don't like the idea of backporting: if we are going to be
>> patching systems and forcing
>> upgrades, why not to TLS 1.2 which doesn't have these issues?
> 
> Well, that was more or less my question: is using SHA-2 for HMAC with
> TLS < 1.2 really backporting? I just checked RFC 2246 and 4346 and they
> both state:
> 
>     Additional hash algorithms can be defined by cipher suites and
>     used to protect record data, but MD5 and SHA-1 are hard coded into
>     the description of the handshaking for this version of the protocol.

In spite of this wording in the document, changing the PRF in TLSv1.0
and TLSv1.1 to use a different hash is no more difficult that doing
so in TLSv1.2, this has been in active use for several years,
e.g. http://tools.ietf.org/html/draft-chudov-cryptopro-cptls-04

and it is so simple and straightforward, that it can even be done
in Microsoft Windows XP's SChannel through third-party plugins,
a TLS implementation that is TLSv1.0-only, doesn't support
TLS extensions and not even AES-CBC cipher suites (rfc3268, jun 2002).


> 
> So, I'm really under the impression that there is nothing that prevents
> anyone from defining a SHA-2 ciphersuite and using it with TLS < 1.2,
> with the understanding that the PRF (hence the handshake authentication)
> remains based on MD5 + SHA1.

It would amount ot a complete waste of resources to use HMAC-SHA256
in current TLS cipher suites,  HMAC-SHA1 is perfectly sufficient,
at least when it is encrypted like it currently is.


> 
> However, a number of facts (akr's recent message, the restriction in RFC
> 5932, the fact that neither OpenSSL nor GnuTLS accepts to negotiate any
> SHA-2 suite with TLS < 1.2) seems to indicate otherwise, so I wanted to
> check if I missed some good reason not to use SHA-2 suites with TLS <
> 1.2.

I was also surprised to see implementations fail interop for the
_SHA256 ciphersuites from rfc5246 for TLSv1.1 and TLSv1.0 with no
apparent reason.

-Martin