Re: [TLS] Last Call: draft-ietf-tls-rfc4346-bis (The Transport

[Martin Rex <Martin.Rex at sap.com>]

Rob Williams wrote:
> 
> At Thu, 06 Mar 2008 08:32:04 -0800 
> Eric Rescorla wrote:
> > > There seem to be a lot of strong feelings against SHA-224.
> > > I looked at the FIPS amendment which defines it, and it
> > > doesn't appear to be such a horrible thing.  Can someone
> > > explain how NIST got it so wrong?
> >
> > It's not *bad*. It's just unnecessary.
> 
> Agreed. 
> 
> Just as SHA-224 is to SHA-256, 
>         SHA-384 is to SHA-512: truncated with different IV.
> 
> I am looking forward to seeing SHA-384 removed from TLS 1.2.

I consider the size difference between sha-224 and sha-256 sufficiently
small to not have a significant impact on DSA signature operations.

The difference between sha-256, sha-384 and sha-512 is much larger,
and while the effort for calculating sha-384 and sha-512 might
be the same, the resource consumption on keypair and digital signature
generation for/with the DSA algorithm might make a hash with a
size between 256 and 512 bit attractive.

I don't know what the motivation is to create a seperate hash
(same underlying algorithm, different IV and truncated result)
rather than to define the truncation of the Hash within the
DSA signature generation, but I hope/guess there is some difference which
made the cryptographers come up with SHA-384.


-Martin
_______________________________________________
TLS mailing list
TLS at ietf.org
https://www.ietf.org/mailman/listinfo/tls