Re: [TLS] Last Call: draft-ietf-tls-rfc4346-bis (The Transport

[Eric Rescorla <ekr at networkresonance.com>]

At Tue, 4 Mar 2008 21:45:20 +0100 (MET),
Martin Rex wrote:
> 
> Eric Rescorla wrote:
> > 
> > At Tue, 4 Mar 2008 09:58:29 -0800,
> > Paul Hoffman wrote:
> > > 
> > > At 6:19 AM -0500 3/4/08, Rob Dugal wrote:
> > > >section 7.4.1.4.1
> > > >
> > > >Why is SHA-224 not supported as a HashAlgorithm? For completeness 
> > > >shouldn't TLS 1.2 support all the SHA-2 algorithms?
> > > 
> > > Not everyone agrees with the utility of SHA-224, particularly in a 
> > > protocol where AES-128 is mandatory to implement.
> > 
> > Indeed. 
> > 
> > If you want a MAC with effective algorithmic security the same as
> > SHA-256 but shorter, that's what truncated MACs are for.
> 
> SHA-224 is effectively that:
> 
>    SHA-224 is based on SHA-256, but it uses an different
>    initial value and the result is truncated to 224 bits.

Yes, that's my point.

Shaving 4 bytes off of the packet size when the MAC is 32
bits is of extremely marginal value. If what you want is
a MAC that has the same algorithmic security as SHA-256
but you're worried about packet size, use SHA-256 truncated
to 80 bits with the truncated_mac extension.

-Ekr

_______________________________________________
TLS mailing list
TLS at ietf.org
https://www.ietf.org/mailman/listinfo/tls