Re: [Emu] I-D Action: draft-ietf-emu-tls-eap-types-09.txt

[John Mattsson <[e-mail]>]

>It's not so much "Microsoft planning" as this was discussed in EMU years ago, and the WG consensus was to stick with SHA-1.

I don’t remember any such WG consensus (but maybe I am missing something). What I can find in the mailing list archive is that several people pointed out that moving away from SHA-1 is a good idea, that there is no need to use SHA-1, but that the final decision is Microsoft’s:

”To me it feels strange to force future implementations to continue support of SHA-1 when it is completely removed from TLS 1.3.”

”Realistically, PEAP is a vendor-defined protocol.  It is not under the change control of the IETF.  If the vendor agrees to this change, then it's possible.  Otherwise we're stuck with what we have.”

”Moving away from SHA-1 is a good idea as it will only raise questions moving forward.”

”Rather than locking in another dependency such as SHA256, I wonder if this calculation should also use a hash function derived from the TLS handshake”

”I suggest then that we simply use the TLS-Exporter”

https://mailarchive.ietf.org/arch/browse/emu/?gbt=1&index=344mIsmczCfedowJfhVy7WiFq9A


>The current code is shipping in multiple servers and supplicants.  It cannot realistically be changed at this time.

Might be that we are stuck with SHA-1, but irrespectively of why that is the case, I still think that draft-ietf-emu-tls-eap-types should clearly point out the fact that PEAP 1.3 uses SHA-1. I think this is important (and unexpected) information to readers of the document and users of the EAP method. My understanding is that TEAP 1.3 is not using SHA-1.

Cheers,
John

From: Emu <[e-mail]> on behalf of Alan DeKok <[e-mail]>
Date: Friday, 28 October 2022 at 17:36
To: John Mattsson <john.mattsson=[e-mail]>
Cc: [e-mail] <[e-mail]>
Subject: Re: [Emu] I-D Action: draft-ietf-emu-tls-eap-types-09.txt
On Oct 28, 2022, at 10:49 AM, John Mattsson <john.mattsson=[e-mail]> wrote:
> A small nit:
> OLD and tje
> NEW and the

  I'll fix that, thanks.

> PEAP and SHA-1:
> Looks like Microsoft is planning to stick with SHA-1 for PEAP 1.3 [PEAP-PRF]. I think that is the wrong choice. NIST recently stated that they plan to deprecate and eventually disallow _all_ uses of SHA-1. In the end, this is Microsoft’s choice, but I think the fact that PEAP 1.3 still uses SHA-1 should be mentioned in draft-ietf-emu-tls-eap-types. This is important information for people and industries following requirements to disallow all uses of SHA-1.

  It's not so much "Microsoft planning" as this was discussed in EMU years ago, and the WG consensus was to stick with SHA-1.

  The current code is shipping in multiple servers and supplicants.  It cannot realistically be changed at this time.

  If NIST deprecates SHA-1, then we can define PEAP (version n+1), and rely on PEAP version negotiation to fix the issue.

  Alan DeKok.

_______________________________________________
Emu mailing list
[e-mail]
https://www.ietf.org/mailman/listinfo/emu