Re: [Cfrg] tcp-md5 "strength"

[Greg Rose <[e-mail]>]

> On Sep 29, 2016, at 5:14 , Stephen Farrell <[e-mail]> wrote:
> I was just asked for an estimate for how much effort
> it might be to break tcp-md5 [1] and whether (and for
> whom:-) that might be practical, for any interesting
> kind of break.
> 
> If anyone has answers or estimates handy, that'd be
> appreciated.
> 
> Cheers,
> S.
> 
> PS: Yes, I know tcp-md5 is pretty to very crappy,
> sadly, it's still used and hard to displace :-(
> 
> [1] https://tools.ietf.org/html/rfc2385

Appending the shared key to the end of the data to be hashed, as a message digest, is not considered to be safe with any hash function. That's why HMAC was developed. In the face of MD5 being not target collision resistant, I'd say this is a large security vulnerability. Practically speaking, the effort might depend on the length of the messages being transmitted, and their internal format, and I don't know enough about BGP to say for sure. If the messages are multiple blocks, with fairly flexible content in them, there's software out there that can produce messages with the same validation data in seconds.

I do understand that designing a replacement, particularly one without downgrade attacks applicable, is hard, and deploying it will be even harder, but wow, this is BGP! It's a bit important to the functioning of the Interwebs.

Greg.

Phone:  [phone] 
GPG/PGP:  1081A37C  232B EC8F 44C6 C853 D68F  E107 E6BF CD2F 1081 A37C