Re: Standardize RSA/SHA256 ?

[Ólafur Guðmundsson /DNSEXT co-chair <[e-mail]>]

At 04:56 12/05/2006, Jelte Jansen wrote:
> >
> >> For the above reasons, I think that we have time to consider the
> >> correct course of action. There is no need to rush into more
> >> algorithms which require more code on nameservers and resolvers.
> >
> > Yes, or at least, we need to document a more compelling reason to do
> > RSA-SHA-265.
> >
>
>So why is this an issue for RSA/SHA256, and not for
>draft-ietf-dnsext-ds-sha256-05.txt, which also makes SHA256 mandatory?

<Chair-hat=on>
The issues here are slightly different.

DS digest is the SAME for the lifetime of the DS record.
Digest inside a RRSIG is going to be different each time the signature is
regenerated for that set, thanks to the different signature lifespan timers.
Thus in the case of DS an attacker has much longer to be able to generate
a DNSKEY that has a matching DS digest to an existing one.

The WG was advised by our Security Area Advisor (Russ Housley) that any use
of SHA-1 without HMAC wrapper should be retired. As DS was the most vulnerable
the chairs got that effort stared on the spot and RFC4509 should be published
any day now.

<Chair-hat=off>
A mitigating fact that RRSIG is not as vulnerable as plain text, against the
known SHA1 attacks, is the structured data format of an RRset.
Having said that if attack on RRSIG digest, or other structured formats,
is valuable enough some smart people will figure out a way to design
such an attack.

Following up on Hilarie and Rip's messages:
One part of the security analysis should be how long signature lifetime can be
for the different digest algorithms used as a function of time.
This is similar to what is available for lengths of public keys.

         Olafur 


--
to unsubscribe send a message to [e-mail] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>