Subject: Re: [TLS] draft-ietf-tls-psk-new-mac-aes-gcm-01 : portfolio question

From: Peter Gutmann <[email-masked]>
Date: Sat, 23 Aug 2008 22:57:26 +1200

[It looks like outgoing mail from the last few days has been going missing,
 this is a resend.  Apologies in case it did get out and you've seen it
 before...]

Alfred H?nes <[email-masked]> writes:

>During off-list discussions of the changes for the -01 version of draft-ietf-
>tls-psk-new-mac-aes-gcm, it became apparent that there's a certain degree of
>imbalance in the draft regarding the portfolio of combinations of
>AES-{128|256}  with  SHA-{256|384} .

Why is -384 in there at all [0]?  It's a major pain to implement on non-64-bit
processors and just adds to code bloat on everything else.  Why not just stick
with a single unified SHA-256 until SHA-3 comes along in a year or two and
renders them obsolete?

Peter.

[0] Yes, I know the theoretical cryptographic arguments, but there's no sign
    of either -256 or -384 being stronger or weaker until they're displaced by
    SHA-3 anyway.

_______________________________________________
TLS mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/tls

---

From: "Blumenthal, Uri" <[email-masked]>
Date: Sat, 23 Aug 2008 22:54:04 -0400

The biggest reason for keeping SHA-384 is its presence in the Suite B standard.

I'll leave alone my personal opinion of this particular hash, as at this point it is irrelevant.

On 8/23/08 06:57 AM, "Peter Gutmann" <[email-masked]> wrote:

Peter.

--
Regards,
Uri