Peter Gutmann wrote:
steffen <stef...@sdaoden.eu> writes:
That is: whether "vulnerability" thus means to create a fake packet with
identical MD-5 and SHA-1 hashes (it seems TLSv1.1 always uses both
concurrently, at least for RSA) as the cryptographically verifiable one that
ships with the packet.
It seems to me this is hard stuff, especially for "the occasional attack".
It's not just hard, for TLS it's pretty much impossible. The collision
attacks against SHA-1 have been chosen-prefix and very much offline which you
can't do with TLS. Even then, it's only the handshake which uses SHA-1, the
rest uses HMAC-SHA1 which, even for MD5, is still secure. Finally, TLS < 1.2
uses MD5+SHA1 in combination, which no-one has found an actual attack on yet.
So in this case TLS 1.2 is actually weaker than TLS 1.1.
This actually raises an interesting question from my perspective. If
concatenating MD5+SHA1 (which I would guess was done because the TLS
designers were unsure which would hold up better) proves sufficient to
confound attacks, how strong does such a confounding digest need to be?
More specifically, could even a non-cryptographic function, such as CRC
or Fowler-Noll-Vo, be sufficient to prevent an SHA1 (or even MD5)
collision attack? While second (and even first) preimages are
straightforward for CRC, would the cryptographic attack on SHA1 (or MD5)
conflict with maintaining the non-cryptographic digest value?
I ask because CRC (and FNV) are extremely cheap to compute compared to
actual cryptographic digests. Would a combination with a
non-cryptographic digest significantly strengthen a cryptographic digest?
-- Jacob
