Subject: Re: [TLS] Consensus Call: FNV vs SHA1

From: "Jeffrey A. Williams" <[email-masked]>
Date: Mon, 10 May 2010 16:08:28 -0500 (GMT-05:00)

All,

  Given these as the choices, I favour FNV-1a reluctantly.
Nither are adaquate to meet the current challanges...

-----Original Message-----
>From: Martin Rex <[email-masked]>
>Sent: May 10, 2010 3:35 PM
>To: Joseph Salowey <[email-masked]>
>Cc: [email-masked]
>Subject: Re: [TLS] Consensus Call: FNV vs SHA1
>
>Joseph Salowey wrote:
>> 
>> I don't see much new being added to this discussion at this point.  I'd
>> like to close on this.  If you have an opinion please indicate if:
>> 
>> a) You favor SHA-1
>> b) You favor FNV-1a
>
>
>b) I favour FNV-1a
>
>
>I think that (a) is underexplained, whereas (b) is pretty clear to me.
>
>-Martin
>_______________________________________________
>TLS mailing list
>[email-masked]
>https://www.ietf.org/mailman/listinfo/tls

Regards,

Jeffrey A. Williams
Spokesman for INEGroup LLA. - (Over 294k members/stakeholders and growing, strong!)
"Obedience of the law is the greatest freedom" -
   Abraham Lincoln

"Credit should go with the performance of duty and not with what is very
often the accident of glory" - Theodore Roosevelt

"If the probability be called P; the injury, L; and the burden, B; liability
depends upon whether B is less than L multiplied by
P: i.e., whether B is less than PL."
United States v. Carroll Towing  (159 F.2d 169 [2d Cir. 1947]
===============================================================
Updated 1/26/04
CSO/DIR. Internet Network Eng. SR. Eng. Network data security IDNS. div. of
Information Network Eng.  INEG. INC.
ABA member in good standing member ID 01257402 E-Mail [email-masked]
Phone: 214-244-4827

---

From: "Blumenthal, Uri - 0668 - MITLL" <[email-masked]>
Date: Tue, 11 May 2010 13:14:43 -0400

If you're talking about Birthday Paradox - then just figure out how many bits of hash suffice to minimize the risk to acceptable level.

If you're talking about Birthday Paradox ATTACK - you're in the Crypto realm, and say "welcome" to SHA256 (which you probably already have in your code :-). And don't forget algorithm agility.

Regards,
Uri

----- Original Message -----
From: [email-masked] <[email-masked]>
To: Michael D'Errico <[email-masked]>
Cc: [email-masked] <[email-masked]>
Sent: Tue May 11 13:04:19 2010
Subject: Re: [TLS] Consensus Call: FNV vs SHA1

On Tue, May 11, 2010 at 09:38:31AM -0700, Michael D'Errico wrote:
> With a birthday collision of 64 bits (thanks Dave for reminding me of
> this), you would need about 6 million server certificates to achieve a
> probability of 1 in a million that 2 of those 6 million certificates
> hash to the same value.  Since servers change certificates about once
> a year, and a client doesn't need to remember any hashes of expired
> certificates, and there is no problem if the certificates of unrelated
> servers collide, this seems to be a non-issue.

I agree that collisions will be extremely unlikely.  My concern is how
to recover from them if they occur.

> The only question is whether FNV is as good of a hash function as is
> required to resist the birthday attack.  My simple test showed that it
> might be, but IANAC and don't know how to determine that.

Based on a gut feeling I'd rather go with a cryptographic hash if
collision resistance is desired.  (Though, of course collision
resistance is not the same thing as having a low rate of collisions
with real world inputs.)

Nico
--

---

From: Nicolas Williams <[email-masked]>
Date: Tue, 11 May 2010 12:23:20 -0500

On Tue, May 11, 2010 at 01:14:43PM -0400, Blumenthal, Uri - 0668 - MITLL wrote:
> If you're talking about Birthday Paradox - then just figure out how
> many bits of hash suffice to minimize the risk to acceptable level.

Yes.

> If you're talking about Birthday Paradox ATTACK - you're in the Crypto
> realm, and say "welcome" to SHA256 (which you probably already have in
> your code :-). And don't forget algorithm agility.

Well, there's an attack, yes, but it's a _DoS_ attack, and so not really
one we should be too concerned with.  However, if the DoS were
particularly difficult to recover then it'd be a DoS we'd want to
protect against by using a stronger cryptographic hash.  I think this
failure mode will be obnoxious, but not so obnoxious as to require that
we go to SHA-256.

Nico
--