Re: Additional suggested cleanups for TLS

Be careful here. The reason SSL used only MD5 for the final phase of the
export case is that we were advised that it might be difficult to get a
CJ for products that used SHA in that step.

>  2) Mixing MD5 and SHA in a single ad-hoc function probably doesn't
>     buy anything because it is difficult to imagine a situation in
>     which SHA is broken but MD5 remains sound.

I have a pretty good imagination. :-)

Another issue concerns the MAC for the Finished messages. There was MUCH
discussion about whether they should be constructed like HMAC rather
than the ad hoc algorithm that was chosen. The tradeoffs are fairly
simple.

   pro) Using HMAC is more secure (probably).

   con) The server has to retain the entire handshake until it
	can compute the master_secret. The storage requirements
	for heavily used secure servers could be prohibitive.
	(Some information, e.g. the server's certificate chain
	is probably constant across all handshakes; and that
	helps a little.)

PK
--
Philip L. Karlton		karlton@netscape.com
Principal Curmudgeon		http://www.netscape.com/people/karlton
Netscape Communications Corporation

    Everything should be made as simple as possible, but not simpler.
	-- Albert Einstein

Received on Tuesday, 17 December 1996 14:17:50 UTC