On Monday, 11 June 2018 23:52:55 CEST David Benjamin wrote: > In both TLS 1.2 and TLS 1.3, SHA-256 isn't hardcoded per se. It's a > function of the cipher suite you negotiate (and also, separately, the > signature algorithm you negotiate). That said, in practice, both are pretty > solidly dependent on SHA-256. Most options involve it. AES-128-GCM and > ChaCha20-Poly1305 are currently paired with SHA-256 while only AES-256-GCM > is paired with SHA-384. > > We could certainly define new cipher suites for either of TLS 1.2 and TLS > 1.3 as needed. But defining a new cipher suite for TLS 1.2 doesn't > magically deploy it for all existing TLS 1.2 servers. Those servers must > deploy new code, at which point updating your TLS library to include it > would also pull in TLS 1.3 anyway (or whatever the latest TLS version is by > then).
except that introduction of a new ciphersuite is far less intrusive change that a completely new protocol like TLS 1.3 API/ABI compatibility is also a factor, where the behaviour with session resumption, client certificate based authentication and PSK handling is different between TLS 1.2 and TLS 1.3 > So I think there will likely be no point in bothering with TLS 1.2 > allocations at that point. More options means more combinatorial complexity > for implementations, which means more our rather limited collective > resources in this space get even more thinly spread. ciphersuites are usually defined by their settings, where addition of a new ciphersuite, which uses already implemented PRF, cipher and key exchange requires only addition of new entry in an array, not complete reworking of parts of the codebase... > David > > On Mon, Jun 11, 2018 at 5:25 PM Daniel Migault <daniel.miga...@ericsson.com> > wrote: > > Hi, > > > > TLS 1.2 uses sha256 as the prf hash function. When sha256 will not be > > considered secured, I am wondering if we can reasonably envision > > deprecating sha256 for TLS 1.2 or if TLS 1.2 will at that time be > > deprecated in favor of TLS 1.X X>= 3 ? > > > > In other words, I am wondering how much we can assume TLS 1.2 is > > associated to sha256. > > > > Yours, > > Daniel > > > > > > _______________________________________________ > > TLS mailing list > > TLS@ietf.org > > https://www.ietf.org/mailman/listinfo/tls -- Regards, Hubert Kario Senior Quality Engineer, QE BaseOS Security team Web: www.cz.redhat.com Red Hat Czech s.r.o., Purkyňova 115, 612 00 Brno, Czech Republic
signature.asc
Description: This is a digitally signed message part.
_______________________________________________ TLS mailing list TLS@ietf.org https://www.ietf.org/mailman/listinfo/tls
