eap Mailing List: Re: SHA-0 Broken

[Bernard Aboba (aboba]

> First, is TLS affected by this vulnerability? This idea came in mind
> since the PRF relies on the abovementioned (semi-)broken cryptographic
> algorithms.
>
> PRF(secret, label, seed) =
> P_MD5(S1, label + seed) XOR P_SHA-1(S2, label + seed);

My understanding is that this PRF was used in part so that it would only
be compromised if *both* MD5 and SHA-1 were broken.

> Second, are EAP methods, that make use of TLS, subsequently
> be threatened?

If SHA-1 were broken, this would be problem not only for TLS, but also for
any other key management protocol that uses a PRF based on SHA-1.  But
that hasn't happened yet.