Re: [TLS] Serious crypto problem fixed by envelope HMAC method instead of currently used prefix

[Bodo Moeller <bmoeller@xxxxxxx>]

On Mon, Nov 20, 2006 at 10:08:35AM -0500, Omirjan Batyrbaev wrote:

> I agree that the inclusion of the length value has merit. But only if the
> peer checks the length value.
> With the proposed envelope method even if the peer does not check the length
> value the MAC can not be forged.
> Isn't it better to use a more robust envelope method instead? It is a small
> change to the spec and implementations.

TLS uses HMAC, which *is* a "robust envelope method", and is not
subject to the attacks that you mentioned -- so there's no need to
change any of this in TLS.  Your attacks would apply to a plain SHA-1
of the key followed by the message, but that's not what HMAC does:

    http://www-cse.ucsd.edu/~mihir/papers/hmac.html
    http://en.wikipedia.org/wiki/HMAC

Bodo


_______________________________________________
TLS mailing list
TLS@xxxxxxxxxxxxxx
https://www1.ietf.org/mailman/listinfo/tls