Subject: Re: [TLS] Last Call: draft-ietf-tls-rfc4346-bis (The Transport

From: Rob Williams <[email-masked]>
Date: Mon, 10 Mar 2008 13:30:07 -0400

At Thu, 06 Mar 2008 08:32:04 -0800 
Eric Rescorla wrote:
> > There seem to be a lot of strong feelings against SHA-224.
> > I looked at the FIPS amendment which defines it, and it
> > doesn't appear to be such a horrible thing.  Can someone
> > explain how NIST got it so wrong?
>
> It's not *bad*. It's just unnecessary.

Agreed. 

Just as SHA-224 is to SHA-256, 
        SHA-384 is to SHA-512: truncated with different IV.

I am looking forward to seeing SHA-384 removed from TLS 1.2.

Thanks!

_______________________________________________
TLS mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/tls

---

From: Uri Blumenthal <[email-masked]>
Date: Mon, 10 Mar 2008 13:38:47 -0400

Too early. My crystal ball says - in 5 to 10 years, in the meanwhile  
there may be benefits in a properly truncated SHA512 variation.
--
Regards,
Uri

On Mar 10, 2008, at 1:30 PM, Rob Williams wrote:

> Thanks!<ATT00001.txt>

---

From: Martin Rex <[email-masked]>
Date: Mon, 10 Mar 2008 19:56:23 +0100 (MET)

> I am looking forward to seeing SHA-384 removed from TLS 1.2.

I consider the size difference between sha-224 and sha-256 sufficiently
small to not have a significant impact on DSA signature operations.

The difference between sha-256, sha-384 and sha-512 is much larger,
and while the effort for calculating sha-384 and sha-512 might
be the same, the resource consumption on keypair and digital signature
generation for/with the DSA algorithm might make a hash with a
size between 256 and 512 bit attractive.

I don't know what the motivation is to create a seperate hash
(same underlying algorithm, different IV and truncated result)
rather than to define the truncation of the Hash within the
DSA signature generation, but I hope/guess there is some difference which
made the cryptographers come up with SHA-384.

-Martin

---

From: Martin Rex <[email-masked]>
Date: Tue, 11 Mar 2008 15:31:51 +0100 (MET)

> size between 256 and 512 bit attractive.

I found an strange statement in FIPS-180-2 (with SHA-224 change notice)
http://csrc.nist.gov/publications/fips/fips180-2/fips180-2withchangenotice.pdf

This is from the SHA-224 change notice on page 73 of above document,
in a section titled "Truncation of the Hash Function Output":

   Truncated hash output shall not be used in place of the full hash
   output by standardized applications that reference this Standard,
   e.g. digital signatures (FIPS 186-2) or keyed hash functions used
   for message authentication (FIPS 198).

I'm just not sure what it exactly means:
Does it mean that neither SHA-224 nor SHA-384 should be used in
digital signatures?  To me, this appears to be implied.

I don't see a reason why truncations that are given specific names
(such as SHA-224 and SHA-384) should not be considered truncations.

On the other hand, the statement about truncation of keyed hash
functions used for message authentication appears confused me.
IPsec does truncation on purpose, but this statement in FIPS-180-2+
appears to suggest this is a bad idea (and not FIPS-compliant...)

So does someone know what this all means (and can translate it
from FIPS into English language)?

-Martin