How does the TLS cipher suite DHE-RSA-AES128-CCM8 work without hashing algorithm

Question

I came across cipher suites without hashing algorithm, when inspecting the mbedTLS (previously Polar SSL) TLS cipher suite list.

For example:

• TLS-DHE-RSA-WITH-AES-128-CCM-8 (OpenSSL: DHE-RSA-AES128-CCM8)
• TLS-DHE-RSA-WITH-AES-256-CCM-8 (OpenSSL: DHE-RSA-AES256-CCM8)

As stated in other questions, the hashing algorithm has applications in TLS, even with AEAD ciphers/modes of operation.

How do these TLS cipher suites work without hashing algorithm and how do they compare to their counterparts with a hashing algorithm, considering the security?

Answer 1

These Cipher Suites are defined in RFC 6655 and use TLS v1.2's default: SHA-256.

To quote it from the RFC:

These ciphersuites make use of the default TLS 1.2 Pseudorandom
Function (PRF), which uses HMAC with the SHA-256 hash function.

The default-ness of SHA-256 is probably inferred from the following parapgraph from RFC 5246:

In this section, we define one PRF, based on HMAC. This PRF with the SHA-256 hash function is used for all cipher suites defined in this
document and in TLS documents published prior to this document when
TLS 1.2 is negotiated. New cipher suites MUST explicitly specify a
PRF and, in general, SHOULD use the TLS PRF with SHA-256 or a
stronger standard hash function.