RE: [TLS] Issue 49: Finished.verify length

[<Pasi.Eronen at nokia.com>]

Bodo Moeller wrote:
> But you don't need a very long verify_data.  We also don't need 
> very long record-layer MACs.  Both are needed only for real-time
> authentication, which cannot be attacked after the fact. 

This is true; but reasonable people seem to have different opinions 
on what exactly is "sufficiently long". For example, RFC 4106 specifies
three different choices for ICV (MAC) length (128/192/256 bits).

My suggestion was *not* to increase the current length, but rather 
to add "agility" for this parameter as well (so that we don't
need to revisit the TLS base spec if, e.g., some future cipher 
suite wants to have all the pieces at 256-bit level).

Best regards,
Pasi

_______________________________________________
TLS mailing list
TLS at lists.ietf.org
https://www1.ietf.org/mailman/listinfo/tls