Hi Sophie, I'm not going to ride a dead horse ... My point of view can be found here:
https://mailarchive.ietf.org/arch/msg/tls/Q-ZAH0cyd6vM1iG0QreHDtan0dg/ Now given your example: Am Montag, dem 13.07.2026 um 08:27 -0700 schrieb Sophie Schmieg: > If your ship was hit by a cannon ball, you fix the hole (i.e. > deprecate DUAL_EC_DRBG), but you then do not go ahead and expend all > your repair supplies on further hardening this particular part of the > hull, given that the next cannon ball is sure to come, and equally > sure to hit somewhere else entirely. In Germany we like to say: "Nicht alles was hinkt, ist ein Beispiel." (Please use Google's AI to understand that meme.) Given the fact, I would be the commander on that ship and having the duty to bring 'Princess Lea' [1] to the next safe harbor. While spotting at the horizon some other ship approaching me, dunne know whether friend or foe. Given also, that I have had experiences with pirates to blast their cannon balls at me, I would command my sailors to 'rock the boat' thus we are a much more difficult target to aim and in essence, the cannon balls don't hit the ship. Ok, while approaching, I figured out: It was a friend, thus I owe my brave seaman a jar of rum. Rather, indeed it was a pirate ship, visible by their black flag with a scull and bones. They are running now short on amunition and I can defend my ship and sail away, leaving some frustrated pirates behind. I'll shout to my people: "Hail Lea!". And they respond: "Captain, you safed our ass again! But what about the rum?" > Unnecessary hash function calls do have a cost, and if they do not > provide meaningful defense in depth (such as the hash of shame), they > should be omitted, and the effort/latency budget be invested in more > impactful hardening exercises. Better to spend a jar of rum instead of being countersunk (by pirates). A hash function would do ... Regards. --eh. [1] https://www.asciimation.co.nz/ -- Dr. Erwin Hoffmann | www.fehcom.de PGP key-id: 36553F7F9C58D1CC PGP key-fingerprint: 950B 5555 0B08 5A2A 1C00 9594 3655 3F7F 9C58 D1CC
signature.asc
Description: This is a digitally signed message part
_______________________________________________ TLS mailing list -- [email protected] To unsubscribe send an email to [email protected]
