[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <66BECFA9.9080708@gmail.com>
Date: Thu, 15 Aug 2024 23:03:53 -0500
From: Jacob Bachmeyer <jcb62281@...il.com>
To: oss-security@...ts.openwall.com
CC: Peter Gutmann <pgut001@...auckland.ac.nz>
Subject: Re: collision confounders (was: feedback requested
regarding deprecation of TLS 1.0/1.1)
Peter Gutmann wrote:
> steffen <steffen@...oden.eu> writes:
>
>
>> That is: whether "vulnerability" thus means to create a fake packet with
>> identical MD-5 and SHA-1 hashes (it seems TLSv1.1 always uses both
>> concurrently, at least for RSA) as the cryptographically verifiable one that
>> ships with the packet.
>>
>> It seems to me this is hard stuff, especially for "the occasional attack".
>>
>
> It's not just hard, for TLS it's pretty much impossible. The collision
> attacks against SHA-1 have been chosen-prefix and very much offline which you
> can't do with TLS. Even then, it's only the handshake which uses SHA-1, the
> rest uses HMAC-SHA1 which, even for MD5, is still secure. Finally, TLS < 1.2
> uses MD5+SHA1 in combination, which no-one has found an actual attack on yet.
> So in this case TLS 1.2 is actually weaker than TLS 1.1.
>
This actually raises an interesting question from my perspective. If
concatenating MD5+SHA1 (which I would guess was done because the TLS
designers were unsure which would hold up better) proves sufficient to
confound attacks, how strong does such a confounding digest need to be?
More specifically, could even a non-cryptographic function, such as CRC
or Fowler-Noll-Vo, be sufficient to prevent an SHA1 (or even MD5)
collision attack? While second (and even first) preimages are
straightforward for CRC, would the cryptographic attack on SHA1 (or MD5)
conflict with maintaining the non-cryptographic digest value?
I ask because CRC (and FNV) are extremely cheap to compute compared to
actual cryptographic digests. Would a combination with a
non-cryptographic digest significantly strengthen a cryptographic digest?
-- Jacob
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
