Re: [Cfrg] RFC 5742 conflict review for draft-dolmatov-kuznyechik

["Blumenthal, Uri - 0553 - MITLL" <[e-mail]>]

>> > We got good use out of those two [RC4 and MD5] mechanisms.
> 
> Both were broken in the same year as their introduction: the initial byte bias
> of RC4 was immediate, and collisions in the MD5 collision function not long
> after.

Pure and unadulterated BS. Accompanied by the usual charming manners, and
total disregard for practical realities of the industry.

First collision in MD5 was published in 2004: Collisions for Hash Functions
MD4, MD5, HAVAL-128 and RIPEMD <https://eprint.iacr.org/2004/199>  and Hot
to Break MD5 and Other Hash Functions
<http://merlot.usc.edu/csac-f06/papers/Wang05a.pdf> .

Hans Dobbertin (OBM) published his work that suggested a possibility of
successful attack The Status of MD5 After a Recent Attack
<http://www.ietf.org/mail-archive/web/pkix/current/pdffqfUJq_6HW.pdf>  and
Cryptanalysis of MD5 Compress
<https://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=1&cad=rja&uac
t=8&ved=0ahUKEwj34aLMnd_KAhUEfxoKHaREAMMQFggdMAA&url=http%3A%2F%2Fcseweb.ucs
d.edu%2F~bsy%2Fdobbertin.ps&usg=AFQjCNGnh9K0NTObOM61gXTdUI1lUvrxWg&sig2=27v7
NhRilr22zza9SWhfvg>  in 1996. He wrote in 1996 in RSA Laboratories
CryptoBytes (if you remember what it is):
> "The presented attack does not yet threaten practical applications of MD5, but
> it comes rather close… in the future MD5 should no longer be implemented …
> where a collision-resistant hash-function is required."

Of course everybody remembers that one of the HMAC claims-to-fame was that
it remains strong even if collisions are found in the underlying hash
function, which is how most protocols that employ hash for authentication
used it.

Not that I hope to convince anybody of anything, or to be heard by those who
probably would've benefited the most from it :), but it felt nice to go back
to those times for a moment.