Re: [Cfrg] RFC 5742 conflict review for draft-dolmatov-kuznyechik

[Watson Ladd <[e-mail]>]

On Thu, Feb 4, 2016 at 3:21 PM, Blumenthal, Uri - 0553 - MITLL
<[e-mail]> wrote:
>> We got good use out of those two [RC4 and MD5] mechanisms.
>
> Both were broken in the same year as their introduction: the initial byte
> bias of RC4 was immediate, and collisions in the MD5 collision function not
> long after.
>
> Pure and unadulterated BS. Accompanied by the usual charming manners, and
> total disregard for practical realities of the industry.

Here's the September 1994 post revealing RC4:
http://web.archive.org/web/20080207125928/http://cypherpunks.venona.com/archive/1994/09/msg00304.html

By September 1995 Andrew Roos has posted the first distinguisher. He's
actually announced it a few months earlier, according to secondary
sources, but I couldn't find any direct link to the Usenet post. Below
shows that it's on what passed for an eprint server at the time. I'd
call that broken within the year.
https://groups.google.com/forum/#!searchin/sci.crypt/andrew$20roos/sci.crypt/xqwP-3NaTdM/4qn28owcFkoJ

Here's the September response from RSA inc.
https://groups.google.com/forum/#!searchin/sci.crypt/andrew$20roos/sci.crypt/5RXjlNthOFI/hkYx2XjAFQkJ

Was 3DES a viable alternative? Of course: it was the MTI cipher in
SSLv3 etc, where RC4 wasn't. Would this have cost more sparse CPU
time? Of course. But as CPU got cheaper, RC4 stayed enabled, even as
attacks mounted up. The practical reality of this industry is that
people don't change configuration and don't change defaults, that
programmers don't know how to write secure code, and everyone assumes
that the standards people are doing their job.

>
> First collision in MD5 was published in 2004: Collisions for Hash Functions
> MD4, MD5, HAVAL-128 and RIPEMD and Hot to Break MD5 and Other Hash
> Functions.
>
> Hans Dobbertin (OBM) published his work that suggested a possibility of
> successful attack The Status of MD5 After a Recent Attack and Cryptanalysis
> of MD5 Compress in 1996. He wrote in 1996 in RSA Laboratories CryptoBytes
> (if you remember what it is):
>
> "The presented attack does not yet threaten practical applications of MD5,
> but it comes rather close… in the future MD5 should no longer be implemented
> … where a collision-resistant hash-function is required."

So what should the response have been according to this very sentence?
Obviously it's to start planning to replace MD5, phase it out across
protocols, start removing it from products, not include it in new
protocols: that's what "no longer should be implemented" means.

Actual IETF response: keep using MD5, insist in 2004 that we can keep
using MD5  despite collisions(https://www.ietf.org/rfc/rfc4270.txt),
do nothing in 2007 in response to Marc Stevens, do nothing in 2008/9
in response to Sotirov, and only in 2011 start depreciating
MD5(https://www.rfc-editor.org/rfc/rfc6151.txt).

Why is this history relevant? Because it shows that if we adopt a
cryptosystem, it will continue to be used for a long time even as
increasingly successful attacks are found against it. Therefore we
should pay careful attention to the security of schemes we do pick.
That's coupled with the susceptibility of many protocols to downgrade
attacks: you are only as secure as the weakest enabled protocol, not
the strongest. Supposedly algorithm agility was supposed to fix this:
in reality it enabled all kinds of attacks while not solving what it
was supposed to solve.

>
>
> Of course everybody remembers that one of the HMAC claims-to-fame was that
> it remains strong even if collisions are found in the underlying hash
> function, which is how most protocols that employ hash for authentication
> used it.

This comment completely ignores the use of hash functions in
signatures and to verify integrity of files. That second usage is one
of the most enduring uses of MD5, and that first usage is one where
any collision is immediately fatal.
>
> Not that I hope to convince anybody of anything, or to be heard by those who
> probably would've benefited the most from it :), but it felt nice to go back
> to those times for a moment.
>
>
>
> _______________________________________________
> Cfrg mailing list
> [e-mail]
> https://www.irtf.org/mailman/listinfo/cfrg
>



-- 
"Man is born free, but everywhere he is in chains".
--Rousseau.