Subject: [eap] Re: SHA-0 Broken

From: Bernard Aboba <[email-masked]>
Date: Tue, 17 Aug 2004 10:13:00 -0700 (PDT)

> First, is TLS affected by this vulnerability? This idea came in mind
> since the PRF relies on the abovementioned (semi-)broken cryptographic
> algorithms.
>
> PRF(secret, label, seed) =
> P_MD5(S1, label + seed) XOR P_SHA-1(S2, label + seed);

My understanding is that this PRF was used in part so that it would only
be compromised if *both* MD5 and SHA-1 were broken.

> Second, are EAP methods, that make use of TLS, subsequently
> be threatened?

If SHA-1 were broken, this would be problem not only for TLS, but also for
any other key management protocol that uses a PRF based on SHA-1.  But
that hasn't happened yet.
_______________________________________________
eap mailing list
[email-masked]
http://mail.frascone.com/mailman/listinfo/eap

---

From: Mohamad Badra <[email-masked]>
Date: Tue, 17 Aug 2004 20:26:20 +0200

>be compromised if *both* MD5 and SHA-1 were broken.
Add to that, if SHA-1 will be broken, this does not mean that HMAC_hash 
is automatically broken since TLS-PRF uses HMAC_hash instead of hash. So 
you need to find also the "aleatory key" used with HMAC_hash to achieve 
such attack. Note that the actual attacks are based on known IVs.

IMO, even if someone will arrive to change a bitstream into a particular 
"text file", it remains extremely hard to him to play with the structure 
of ASN.1 used in degital signatures.

Badra