Re: [TLS] Issue 66: HMAC-256 based ciphersuites

[miura.fumiaki at lab.ntt.co.jp (MIURA, Fumiaki)]

At Wed, 09 Jan 2008 10:30:17 +0100, Florian Weimer wrote:
> 
> * Fumiaki MIURA:
> 
> > At Tue, 8 Jan 2008 12:53:25 +0200, <Pasi.Eronen at nokia.com> wrote:
> >> TLS_RSA_WITH_AES_256_CBC_SHA256   
> >
> > Why not SHA512 for AES256?
> >
> > For example, FIPS 180-2 say that `security (bits)' for SHA-512 is 256
> > in page 3.
> 
> Does this estimate also apply when using SHA-512 as a building block
> for an HMAC?

I think yes, theoretically.

"Message authentication using hash functions: The HMAC construction"
  <URL: http://www-cse.ucsd.edu/users/mihir/papers/hmac-cb.pdf>  says:
| As shown in [12, 2], birthday attacks, that are
| the basis to finding collisions in cryptographic hash
| functions, can be applied to attack also keyed MAC
| schemes based on iterated functions (including also
| CBC-MAC, and other schemes). These attacks ap-
| ply to most (or all) of the proposed hash-based
| constructions of MACs.

But, I don't know any realistic attacks if we properly refresh the
key.


_______________________________________________
TLS mailing list
TLS at lists.ietf.org
https://www1.ietf.org/mailman/listinfo/tls