IETF Logo Mail Archive

Re: [Anima-bootstrap] [Spasm] SHA1 usage in Anima-bootstrap voucher yang

Michael Richardson <mcr+ietf@sandelman.ca> Fri, 03 March 2017 22:51 UTC

Return-Path: <mcr+ietf@sandelman.ca>
X-Original-To: anima-bootstrap@ietfa.amsl.com
Delivered-To: anima-bootstrap@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E206B12965B; Fri, 3 Mar 2017 14:51:59 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.901
X-Spam-Level:
X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id j7tWIdKX2Ne7; Fri, 3 Mar 2017 14:51:58 -0800 (PST)
Received: from tuna.sandelman.ca (tuna.sandelman.ca [209.87.249.19]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6D0D8129657; Fri, 3 Mar 2017 14:51:58 -0800 (PST)
Received: from sandelman.ca (obiwan.sandelman.ca [IPv6:2607:f0b0:f:2::247]) by tuna.sandelman.ca (Postfix) with ESMTP id 53E732009E; Fri, 3 Mar 2017 18:14:23 -0500 (EST)
Received: from obiwan.sandelman.ca (localhost [IPv6:::1]) by sandelman.ca (Postfix) with ESMTP id 64ED0636BB; Fri, 3 Mar 2017 17:51:57 -0500 (EST)
From: Michael Richardson <mcr+ietf@sandelman.ca>
To: Russ Housley <housley@vigilsec.com>
In-Reply-To: <8C184CD7-69EB-424B-9D95-1C64A8FD706F@vigilsec.com>
References: <18454.1488305685@obiwan.sandelman.ca> <14573.1488419571@obiwan.sandelman.ca> <8C184CD7-69EB-424B-9D95-1C64A8FD706F@vigilsec.com>
X-Mailer: MH-E 8.6; nmh 1.6+dev; GNU Emacs 24.5.1
X-Face: $\n1pF)h^`}$H>Hk{L"x@)JS7<%Az}5RyS@k9X%29-lHB$Ti.V>2bi.~ehC0; <'$9xN5Ub# z!G,p`nR&p7Fz@^UXIn156S8.~^@MJ*mMsD7=QFeq%AL4m<nPbLgmtKK-5dC@#:k
MIME-Version: 1.0
Content-Type: multipart/signed; boundary="=-=-="; micalg="pgp-sha256"; protocol="application/pgp-signature"
Date: Fri, 03 Mar 2017 17:51:57 -0500
Message-ID: <24239.1488581517@obiwan.sandelman.ca>
Archived-At: <https://mailarchive.ietf.org/arch/msg/anima-bootstrap/0jV66ntG6AsmOGlTJl24A7XQKRA>
Cc: SPASM <SPASM@ietf.org>, anima-bootstrap <anima-bootstrap@ietf.org>
Subject: Re: [Anima-bootstrap] [Spasm] SHA1 usage in Anima-bootstrap voucher yang
X-BeenThere: anima-bootstrap@ietf.org
X-Mailman-Version: 2.1.17
Precedence: list
List-Id: Mailing list for the bootstrap design team of the ANIMA WG <anima-bootstrap.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/anima-bootstrap>, <mailto:anima-bootstrap-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/anima-bootstrap/>
List-Post: <mailto:anima-bootstrap@ietf.org>
List-Help: <mailto:anima-bootstrap-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/anima-bootstrap>, <mailto:anima-bootstrap-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 03 Mar 2017 22:52:00 -0000

Russ Housley <housley@vigilsec.com> wrote:
    > I’m sure you know that there are three important properties for hash
    > functions.  The are:

Yes.

    > In the system you describe, it seems that an attacker would need to
    > find a preimage.  For SHA-1, we do not know of a way to do that yet,
    > but the 160-bit have value produced by SHA-1 is probably not big enough
    > to be considered safe in today's computing environment.

    > It seems very odd to be developing a new standards that is using a hash
    > function that was deprecated at the end of 2010 by NIST.

    > My personal recommendation ould be to move from SHA-1 to SHA-256.

Yes, I agree completely.

What I'm asking for, is if there is a good, well-established container that
we can reference, that essentially gives us the agility to move from SHA1 to
SHA256, and to SHA3 if we have to.

Alternatively, for the use case involved, which is to refer to a certificate
by reference-to-CA + reference-to-DN, if there is some other construct that
would better do what we want, and *also* provide us with the agility we would
like.

(Some ownership vouchers may sit in filing cabinets for a few decades in
a warehouse somewhere)


--
Michael Richardson <mcr+IETF@sandelman.ca>, Sandelman Software Works
 -= IPv6 IoT consulting =-

v2.23.0 | Report a Bug | By Email