Subject: [TLS] draft-ietf-tls-ecdhe-psk / text about SHA-1

From: <[email-masked]>
Date: Fri, 30 Jan 2009 12:28:46 +0100

Hi,

Tim Polk pointed out that draft-ietf-tls-ecdhe-psk-05 has text that
could be read to suggest HMAC-SHA1 is on its last legs:

   "Given the current state of published to date crypto attacks, HMAC-
   SHA1 apparently is not (yet) so bad that we need to risk breaking
   interoperability with previous versions of TLS."

That probably does not accurately reflect current thinking (HMAC-SHA1
will probably continue to be OK for quite some time, even if new
weaknesses in SHA-1 are discovered). Furthermore, talking about
breaking interoperability isn't really accurate either, because
there are no legacy implementations of these cipher suites.

The author has suggested rephrasing this as follows:

OLD:
   Given the current state of published to date crypto attacks, HMAC-
   SHA1 apparently is not (yet) so bad that we need to risk breaking
   interoperability with previous versions of TLS.  However,
   implementers and administrators should monitor the general statements
   on recommended cryptographic algorithms published from time to time
   by various forums including the IETF, as a base for the portfolio
   they support and the policies for strength of function acceptable for
   the cipher suites they set.
NEW:
   Implementers and administrators should monitor the general
   statements on recommended cryptographic algorithms (e.g., SHA-1 hash
   function) published from time to time by various forums including
   the IETF, as a base for the portfolio they support and the policies
   for strength of function acceptable for the cipher suites they set.

If you're strongly opposed to this change, please say so ASAP.

Best regards,
Pasi
_______________________________________________
TLS mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/tls