Re: [Isis-wg] draft-bhatia-manral-crypto-req-isis-01.txt

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

> Thus, collisions with a hashing function are *inevitable*.

The question is, as I've always understood it (?), how long does it take
to produce such a collision? The most recent number I saw, probably two
years ago, I think, was in a presentation by Russ Housley, and was on
the order of 14 seconds.

> This does not make them insecure.  Our purpose in using a hashing
> function is to provide authentication.  We wish to ensure that an
> attacker cannot take an arbitrary packet P' and compute a similar hash
> without knowing the secret.  Collision attacks do not give an attacker
> that capability.

No, but if you can find a large number of packets with a matching hash
in a short period of time, then you may be able to find one that does
have all the correct syntax of a normal IS-IS packets.

I don't think any of us have the definitive answers here, we're just
going by what we've seen in presentations, and on mailing lists, etc. My
general understanding is that there's always points of argument in the
security world, of course, but the idea is to point the way forward
before this becomes an issue, and not after, I think.

:-)

Russ

- --
riw@cisco.com CCIE <>< Grace Alone

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFF6Lc1ER27sUhU9OQRAodXAJ0Q96roXfy13d8BWVNgArdpyp3yDACfUViy
zIcr+pJqUKtlsw8GLaYVkMs=
=w2MH
-----END PGP SIGNATURE-----

_______________________________________________
Isis-wg mailing list
Isis-wg@ietf.org
https://www1.ietf.org/mailman/listinfo/isis-wg