Re: [keyassure] Opening issue #21: "Need to specify which crypto

[Phillip Hallam-Baker <[e-mail]>]

There is currently no evidence that SHA2-256 is unacceptably weak.

However it is based on the same construction as MD4, MD5 and SHA1. And
thus the reason for the current NIST competition.


Since the NIST competition is not currently complete, there is
currently no viable alternative to SHA2. While there are other
algorithms in use, I would expect the competition to supersede those
as well.

I think that what we should do here is

1) Make support for SHA2-256 and SHA2-384 REQUIRED
2) Ensure that it is feasible to transition from use of SHA2 to a new algorithm
3) Deprecate use of MD2,MD4,MD5 and SHA1.


The second point is really rather important since even though it is
possible to emit bit strings that use SHA2 in protocols such as SSL
and S/MIME, it is not feasible to use them in practice because there
is no way to know whether the other party is one of those which is
capable of using them.

On Tue, Mar 1, 2011 at 5:38 PM, Paul Hoffman <[e-mail]> wrote:
> On 3/1/11 1:37 PM, Phillip Hallam-Baker wrote:
>>
>> This particular topic is one on which the Security ADs and the IETF
>> chair have very very specific opinions on. And given their role in
>> trying to effect an industry wide transition to stronger algorithms, I
>> think that they are quite right to insist on them.
>
> If you can quote previous statements from any of them suggesting that
> SHA-256 is suspect, that would be more useful than you simply suggesting
> that they had said something. It would be useful to this discussion for each
> of us to speak only for ourselves and for those who have asked us to speak
> for them, or to quote others whom we think are authorities.
> _______________________________________________
> keyassure mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/keyassure
>



-- 
Website: http://hallambaker.com/