Re: [TLS] draft-turner-ssl-must-not

[Marsh Ray <[e-mail]>]

On Tue, Jul 06, 2010 at 04:17:14AM +0200, Martin Rex wrote:
> 
> The base result is that the strength of concatenation of two
> hash functions improves the result not as much as one might hope.
> 
> It always does improve the result, however.

Putting it another way, if you spend 36 bytes (288 bits) on space
for your hash and it turns out to have only about 2^75 collision
resistance, I'm not sure many people would call that an improvement.

> Which means that SSLv3 is stronger than TLSv1.0 and TLSv1.1
> in that respect.
> 
> Personally, I dislike the extreme truncation of the Finished
> messages in TLS to 12 octets. My expectation is that this limits
> the overall strength, and that it spoils the use of SHA-2 in TLSv1.2.

+1.

There's no logic to it, or whatever there might be is too clever by half.

Apparently, someone was convinced that collision resistance was
irrelevant. So convinced that they were willing to bet your data
on it and not use another 8 or so bytes to transmit the full hash
that had already been computed. I wonder if they realized that
higher layer protocols were attaching semantic value to the
receipt of the Finished message.

But since their reasoning didn't make it into the RFCs so we must
live without it when reviewing things like False Start/Snap Start.
It'd be nice to know what other unstated dependencies and assumptions
the security rests on.

- Marsh