Subject: [ietf-tls] Re: MS hashes

From: Eric Murray <[email-masked]>
Date: Tue, 16 Jan 2001 19:21:47 -0800

On Wed, Jan 17, 2001 at 01:25:54AM +0000, Ben Laurie wrote:
> Eric Murray wrote:
> > 
> > On Fri, Jan 12, 2001 at 08:52:49AM -0000, [email-masked] wrote:
> > > I think it would certainly be useful to re-visit the need for 2 hash
> > > functions in MS generation in TLS version 2, whenever that happens.  I hope
> > > we have MS generation on the SIM/WIM as part of wireless support of TLS, and
> > > support of two hash functions on the smartcard would be something it would
> > > be good to avoid.  (Sorry to keep banging on about limited client
> > > capabilities)
> > 
> > Using two hashes also causes problems for high-performance TLS servers.
> 
> Perhaps you should consider upgrading from the Z80, then? Surely you
> can't be serious about this?

Surely I can.  When you're trying to do 1000 TLS/sec or more, the extra
operations really hurt.  Yes, you can do it in hardware, but there's
also RSA hardware and hardware for the bulk cipher. Each core that you
add to a chip means that something else gets dropped, or the cost goes
up a lot.  Even if you have all hardware crypto, you have to send the
data back over the bus multiple times to get hashed.  Ths bus bandwidth
alone, for four round trips for a hash (HMAC in two algorithms), plus
RSA, plus network traffic, can get close to the practical maximum for
common busses.  Take a look at the TLS spec and count up the number of
hashes and the number of bytes in each for each session.

There's some folks working on putting various parts of TLS in hardware,
which solves some of the problem, but (so far) no one I'm aware of is
putting the handshake into hardware... it's just too variable.

My feeling from talking to the various people who were designing SSLv3
was that the duplicate hashes for the MS were there out of a bit of ad
hoc enginering-- Dobbertin had just published his attack on MD5 and the
feeling was that it was going to fall, and maybe SHA1 too, but that both
together would be good enough, without having to specify the MS hash in
the ciphersuite.  Nothing wrong with that, but they wern't thinking of
running 1k sessions/sec either.

The issue might be worth re-examining now epecially since it'd also be
useful for small devices, so they don't have to implement both hashes
even if they want to use only one for record MACs.

-- 
  Eric Murray           Consulting Security Architect         SecureDesign LLC
  http://www.securedesignllc.com                            PGP keyid:E03F65E5

---
You are currently subscribed to ietf-tls as: [email-masked]
To unsubscribe send a blank email to [email-masked]