[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID:
<ME0P300MB0713B2849ACB451ACDC81707EEBA2@ME0P300MB0713.AUSP300.PROD.OUTLOOK.COM>
Date: Fri, 9 Aug 2024 08:37:28 +0000
From: Peter Gutmann <pgut001@...auckland.ac.nz>
To: "oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com>
Subject: Re: feedback requested regarding deprecation of TLS
1.0/1.1
steffen <steffen@...oden.eu> writes:
>That is: whether "vulnerability" thus means to create a fake packet with
>identical MD-5 and SHA-1 hashes (it seems TLSv1.1 always uses both
>concurrently, at least for RSA) as the cryptographically verifiable one that
>ships with the packet.
>
>It seems to me this is hard stuff, especially for "the occasional attack".
It's not just hard, for TLS it's pretty much impossible. The collision
attacks against SHA-1 have been chosen-prefix and very much offline which you
can't do with TLS. Even then, it's only the handshake which uses SHA-1, the
rest uses HMAC-SHA1 which, even for MD5, is still secure. Finally, TLS < 1.2
uses MD5+SHA1 in combination, which no-one has found an actual attack on yet.
So in this case TLS 1.2 is actually weaker than TLS 1.1.
There's also the issue I cover in:
http://www.cs.auckland.ac.nz/~pgut001/pubs/bollocks.pdf
which is really about quantum cryptanalysis but also covers other attack
types.
Peter.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
