Re: [keyassure] Opening issue #21: "Need to specify which crypto

[Stephen Farrell <[e-mail]>]

On 2 Mar 2011, at 21:24, Phillip Hallam-Baker <[e-mail]> wrote:

> Which is why I am arguing it is time to withdraw SHA1 from service. It
> is only marginally more secure than MD5.

"Marginally"? Evidence please? I dont think exageration helps your case.

S


> 
> 
> 
> On Wed, Mar 2, 2011 at 12:24 PM, Martin Rex <[e-mail]> wrote:
>> Phillip Hallam-Baker wrote:
>>> 
>>> The use of MD2 in a self signed cert has little risk as far as use of
>>> the cert itself goes since it only serves as proof of possession which
>>> is only relevant when the browser provider chooses to install it in
>>> the browser.
>> 
>> In the universe where I live, there exist collision attacks against MD2.
>>  (check http://en.wikipedia.org/wiki/MD2_%28cryptography%29)
>> 
>> So an RSA-key for which a PKCS#1 encrypted MD2 signature has been
>> published is a real security problem and ought to have been discarded
>> long ago.
>> 
>> Else someone could try to use the preimage attack to issue himself
>> an intermediate CA cert under such a root cert, reusing the md2-based
>> signature on the RootCA cert.
>> 
>> I would REALLY like to kill md2withRsaEncryption as a digital
>> signature algorithm from our PKI implementation, like I did
>> with all of md4-based digital signature algorithms.
>> 
>> 
>> Getting rid of "tainted" RSA keys is also important.
>> 
>> Why do you think that FIPS 186-3 says that you are not allowed
>> to use an RSA keypair for both PKCS-v1.5 and PKCS-PSS signatures?
>> Because you "taint" your RSA key on the first time that you use it
>> for a weak scheme.
>> 
>> -Martin
>> 
> 
> 
> 
> -- 
> Website: http://hallambaker.com/
> _______________________________________________
> keyassure mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/keyassure