Subject: RE: [TLS] PRF in TLS 1.2

From: "Blumenthal, Uri" <[email-masked]>
Date: Wed, 27 Sep 2006 08:49:56 -0400

>My thought is that even if one of the hash algorithms is badly broken,
>the fact that more than one hash is being used means that a 'hedge'
>exists against that possibility.

That was the original thought and the reason PRF is what it is now.

>MD5 may be able to be broken.  SHA1 may be able to be broken.

Yes.

>However, their outputs both rely on the original input for their
>value, such that 1 bit of entropy in the input leads basically to 1
>bit of entropy in the output.

Oh no! This is a huge and unproven conjecture, which most likely is
false!  "Engineers" began using hash fnctions pretending their output
was pseudorandom. One notable cryptographic school (Soviet) never
participated in that madness: their hash is based on a real block
cipher.

>So, even if MD5 is broken (such that a valid message
>can be created for message injection/session hijack), the fact that
>another cipher suite is also in use arguably provides at least as much
>security as using that cipher suite alone, and hypothetically more.

Your logic would work only if those were CIPHERS employed in sequence
(super-encryption), so strippng off the weaker layer still leaves one to
contend with the stronger one. AND - this is a big and - if the two
ciphers' keying is TOTALLY independent.

If they're keyed from the same source - then stripping off the weak
layer may tell me something about the key patterns of the strong layer,
thus simplifying my job of breaking the strong layer too (which would
not be achievable without the clues furnished by the weak layer).

>(I cannot attest to theory.)  

See above.

>Especially if the outputs are XORed
>together -- if SHA1 cannot be predicted but MD5 can, there's still the
>entire output space of 160 bits to go through.  If SHA1 can be
>predicted but MD5 cannot, then there's still 128 bits of output space
>to go through.  (Believing that (SHA1 & MD5) has the same amount of
>entropy as (sizeof(SHA1) + sizeof(MD5)) is a fallacy; it has the
>amount of entropy that the largest unpredictable one gives.)

But they are not keyed independently!

Information revealed by the hash could be used to reduce the search
field for the other. Especially if both hash functions have exposed some
chinks in their armour. Maybe yes maybe no - but is it worth taking the
risk?

On 9/26/06, Blumenthal, Uri <[email-masked]> wrote:
> >> "If it ain't broke, don't fix it"?
> >
> >I would phrase it as "make the most minimal change possible"
>
> :-)
>
> >> Will using SHA-1 only result in a weaker PRF than the TLS 1.1 PRF,
> >> which uses both MD5 and SHA-1?
> >
> >This would be a good question to direct at Dan Simon or Hugo
Krawczyk.
> >My intuition is that because the secret is split between the two
> >hashes in the current PRF, this PRF would be arguably stronger
> >than the current PRF if MD5 is badly compromised. In any case,
> >this is a general question of whether we want two hashes
> >rather than a detailed one abt construction.
>
> A PRF based on one decent hash will be stronger.
> Better than PRF based on two (especially including one that's broken).
>
> >> Is it required that the PRF use label and seed only in the form
> >> of their concatenation label + seed?
> >
> >No, I don't think so
>
> It wouldn't be a good idea to force PRF into such use pattern.
>
> _______________________________________________
> TLS mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/tls
>

-- 

-Kyle H

_______________________________________________
TLS mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/tls

---

From: "Blumenthal, Uri" <[email-masked]>
Date: Thu, 28 Sep 2006 19:26:53 -0400

>>>>No it isn't, because each half of the secret by itself has
sufficient
>>>>entropy, as far as we understand the security arguments for all of
>>>>the currently defined ciphersuites.
>>>
>>>I haven't seen a convincing argument for this when the PMS
>>is a Diffie-Hellman ZZ.
>> 
>> There can be no convincing argument, because that statement isn't
true!
>
>It is true, under the Decisional DH assumption (see the first paper I
cited
>in my other reply). What makes you say that it isn't?

Because traditional DH is not Decisional but Computational. Except that
it appears that DH over Elliptic Curve over "proper" field is indeed
Decisional. See the caveat below.

>> It would be true for DH over Elliptic Curve.
>
>The most recent results I know of for ECDH are given in
><http://eprint.iacr.org/2005/324>; if anything the conclusions
>are slightly weaker than for DH.

That guy is talking about quadratic extensions. There are indeed "weak"
curves - however those standardized by NIST are OK.