Re: [Isis-wg] draft-bhatia-manral-crypto-req-isis-01.txt

[Vishwas Manral <[e-mail]>]

Hi Tony,

I understand your concern. I understand the statement saying "making MD5 
very insecure" needs to be well qualified. I agree it is a problem when 
MD5 is used for hashing before a document is signed, as two different 
documents could then have the same hash and hence the same sign. It may 
not necessarily be true in the IS-IS case.

I totally understand that the collision in Hash Functions does not 
necessarily cause the hash mechanism as used in IS-IS to break. 
Collisions are however against the basic design of hash functions. May 
be the text needs to be clarified.

Infact you will see that in the document sighting issues with current 
security mechanisms I have stated the fact that having the checksum 
mitigates the attack However some protocols (OSPF for sure, not sure 
about IS-IS) disable checksum calculation when the security hashing is 
used.

Do let me know if I am wrong here?

Thanks,
Vishwas

Tony Li wrote:
> Hi,
>
> I'd like to take exception to some language found in this draft.  I 
> quote:
>
>   The HMAC-MD5 scheme is also not good enough as there have recently
>    been reports about attacks on the collision resistance properties of
>    MD5 [MD5-attack]. MD5CRK, was a distributed computing project to
>    break the MD5 hash algorithm in a short period of time. The project
>    closed down with the publication of the paper [MD5-attack].
>
>    It was discovered that collisions can be found in MD5 algorithm in
>    less than 24 hours, making MD5 very insecure.
>
> I find this language to simply be irresponsible in that it 
> misconstrues an attack vector and then draws a completely incorrect 
> conclusion and reports it using the most incendiary language possible.
>
> It is correct that it is possible to quickly find a collision for an 
> MD5 hash.  However, just finding a collision does not give an attacker 
> a mechanism to compute a correct hash for an arbitrary packet.  Thus, 
> the attacker does not have a mechanism to forge arbitrary packets and 
> have them injected into IS-IS.  In fact, the most that this process 
> will do is allow the attacker to calculate some other, effectively 
> pseudo-random packet that would have an identical hash.  The odds of 
> such a packet being a syntactically correct IS-IS PDU are long indeed 
> (e.g., is the Fletcher checksum correct?), and the odds of it further 
> performing some attack  of interest within an IS-IS domain are longer 
> still.
>
> Note that I do not disagree that there is a need for replacement 
> algorithms.  Experience has shown that all cryptographic algorithms 
> will eventually be compromised in serious ways.  However, the attack 
> cited is simply not in that category and it is wholly unreasonable to 
> claim that the sky is falling.
>
> I recommend that the WG not accept this draft until this language is 
> revised.
>
> Regards,
> Tony



_______________________________________________
Isis-wg mailing list
[e-mail]
https://www1.ietf.org/mailman/listinfo/isis-wg