Re: [ftpext] draft-ietf-ftpext2-hash command name and default algorithm

[Richard Koenning <[e-mail]>]

Daniel Stenberg wrote:

> On Tue, 18 Jan 2011, Robert Oslin wrote:
> 
>>>>I personally think CRC32 is too weak for multi-gigabyte files.
>>
>>Do you mean that CRC32 is weak period?
> 
> CRC32 uses 32 bits to indicate a checksum for the data. I claim it gets weaker 
> the more data to try to check with it. Having a CRC32 field for a sufficiently 
> small amount of data will be fine IMO - but that's not what we design for 
> here.

 From the draft it is still unclear to me whether the hash shall be used 
only for detecting "normal" transmission problems or also for detecting 
active attacks on the data channel.

For the latter CRC32 is out of discussion not only for the size of the 
hash value but for its linear properties: it is even easy to change the 
data while keeping the CRC unchanged.
Regarding MD5: Since long time cryptologists warn against using MD5 for 
new protocols/applications. As an application of this policy there are 
no newer TLS cipher suites using MD5.
Regarding SHA1: Despite showing some weakness too it is imho still in 
wide usage e.g. in the TLS area. On the other hand the search for new 
long-term hash functions is still ongoing 
(http://csrc.nist.gov/groups/ST/hash/timeline.html). Therefore it seems 
to me still acceptable to use SHA1 as default hash function.

When the hash function is only used for detecting transmission errors 
than the collision probability is one of the main points, this 
probability is approximately the inverse of the square root of the hash 
value space. So with CRC32 one has to expect collisions already with a 
set of some ten thousand files. With MD5 the corresponding number has 19 
figures, which probably suffices already for most applications.

-- 
Dr. Richard W. Könning
Fujitsu Technology Solutions GmbH