IETF Logo Mail Archive

Re: [MMUSIC] 4572 update: forbid weak hashes?

Roman Shpount <roman@telurix.com> Thu, 07 April 2016 19:55 UTC

Return-Path: <roman@telurix.com>
X-Original-To: mmusic@ietfa.amsl.com
Delivered-To: mmusic@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E3E5612D17D for <mmusic@ietfa.amsl.com>; Thu, 7 Apr 2016 12:55:02 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.6
X-Spam-Level:
X-Spam-Status: No, score=-2.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=telurix-com.20150623.gappssmtp.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id EpQFmzTRviiU for <mmusic@ietfa.amsl.com>; Thu, 7 Apr 2016 12:55:01 -0700 (PDT)
Received: from mail-ig0-x234.google.com (mail-ig0-x234.google.com [IPv6:2607:f8b0:4001:c05::234]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6B53D12D0BA for <mmusic@ietf.org>; Thu, 7 Apr 2016 12:55:01 -0700 (PDT)
Received: by mail-ig0-x234.google.com with SMTP id ui10so80150422igc.1 for <mmusic@ietf.org>; Thu, 07 Apr 2016 12:55:01 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=telurix-com.20150623.gappssmtp.com; s=20150623; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc; bh=ZK9x9dvmrMuVQUJJDWk4VEH1PQ8JiGlM6U5XT/6aCb8=; b=oWTFpPJfgnI9xepF7byiRVzjEstvt3jWyXghJoPd8tgN6m3Q797f7D2dgvrEBCef1/ B7CxEeMGEtIuJ/rJ4jbpB02gQ9SOCD8Nmu/wtySciRxujkovVYHZfOOoIPJ7qmg1beAZ o9X17QZEmck2OcwWNKg9X4B/ulV9YUZRWoAj7OCRKP5VeZO9KSm+iDKy7kx2yYlj8JvE JqGuV/nMDgIVt6ibJAuLD238/rFClGGpAqrloSaSk9NZc6Qg4S8XD3EHZ+yOuCu6WH4P quEo0EbOjKRpK7Te7R4aY3Vev8C+d3bofSZeFsyd95CCYjSjYcE+23mzjY89keRuXhlu SwFw==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc; bh=ZK9x9dvmrMuVQUJJDWk4VEH1PQ8JiGlM6U5XT/6aCb8=; b=mN6sDCfBL1xLnOpCcxz8W5TF2AyxQHH3AqaweJfsgocxZ6VnRfU2FSAL0bp54uJfO1 E5QCaUCV3BIK4ppPCF3Q8fe/etLLem+1yJ4p9IQlzxikVPC9DlWK3Iu/OSDoQ2u1WYWh 9lWr0P4tZrUaeZnKi1T6l8AivP7EH580CryIkcd7h7/7aUSlN0OdOf1Dap12JI/x+TCs +hgU/I3yWU/PDl4B1RPD6zmDiXr2hM/3nr2NzhM5Iky/x+cdU05JgIi51CBtOWJrZpRV vkxo0Tziz3i6CgLAd/R6jbTcr2vlRakARidQMj4n4qfwzZcVXdcQwX6pMSR+OU4FnbcU HMZQ==
X-Gm-Message-State: AD7BkJIi5IzbkOpP8s6l8L2QnE6vDsiJSQwI+bZ/Ce/s0t6g2MbuuakgEiJaFBDCBYg4CA==
X-Received: by 10.50.29.73 with SMTP id i9mr5709913igh.32.1460058900745; Thu, 07 Apr 2016 12:55:00 -0700 (PDT)
Received: from mail-io0-f169.google.com (mail-io0-f169.google.com. [209.85.223.169]) by smtp.gmail.com with ESMTPSA id in6sm12349047igb.0.2016.04.07.12.55.00 for <mmusic@ietf.org> (version=TLSv1/SSLv3 cipher=OTHER); Thu, 07 Apr 2016 12:55:00 -0700 (PDT)
Received: by mail-io0-f169.google.com with SMTP id o126so84699829iod.0 for <mmusic@ietf.org>; Thu, 07 Apr 2016 12:55:00 -0700 (PDT)
MIME-Version: 1.0
X-Received: by 10.107.157.70 with SMTP id g67mr4903182ioe.38.1460058899829; Thu, 07 Apr 2016 12:54:59 -0700 (PDT)
Received: by 10.36.106.194 with HTTP; Thu, 7 Apr 2016 12:54:59 -0700 (PDT)
In-Reply-To: <CABkgnnWS030+7xLMdbd+p0bh3805UtRB5fYkOmGuxPcdHLh-1w@mail.gmail.com>
References: <4D60EE45-BECA-4A46-98EF-FF4AA482B42E@vidyo.com> <7594FB04B1934943A5C02806D1A2204B37F27B70@ESESSMB209.ericsson.se> <CABkgnnU0qwkUGLv4rkax3hbat9Fb6kXDH9TKZv3MukepN7PkmQ@mail.gmail.com> <57067AFE.9070704@alum.mit.edu> <CAD5OKxtX9HLWJJgKsG7hNJbRB1muS+fe8Pnnm=g4+=ryPyMN+A@mail.gmail.com> <5706B499.9030209@alum.mit.edu> <CAD5OKxu_Ok2Cpb6Zvim4RtOpab3UY1xMWrJtODVHiqJBR_vfJA@mail.gmail.com> <CABkgnnWS030+7xLMdbd+p0bh3805UtRB5fYkOmGuxPcdHLh-1w@mail.gmail.com>
Date: Thu, 07 Apr 2016 15:54:59 -0400
X-Gmail-Original-Message-ID: <CAD5OKxsVZqOj-HG7_vN4KS+E6=mKurGew=kkRv10u=CJe6QZwQ@mail.gmail.com>
Message-ID: <CAD5OKxsVZqOj-HG7_vN4KS+E6=mKurGew=kkRv10u=CJe6QZwQ@mail.gmail.com>
From: Roman Shpount <roman@telurix.com>
To: Martin Thomson <martin.thomson@gmail.com>
Content-Type: multipart/alternative; boundary="001a1140b472135c95052fea7427"
Archived-At: <http://mailarchive.ietf.org/arch/msg/mmusic/B25IwcyuUhuFJphWn8PsDn8Ns98>
Cc: "mmusic@ietf.org" <mmusic@ietf.org>, Paul Kyzivat <pkyzivat@alum.mit.edu>
Subject: Re: [MMUSIC] 4572 update: forbid weak hashes?
X-BeenThere: mmusic@ietf.org
X-Mailman-Version: 2.1.17
Precedence: list
List-Id: Multiparty Multimedia Session Control Working Group <mmusic.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/mmusic>, <mailto:mmusic-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/mmusic/>
List-Post: <mailto:mmusic@ietf.org>
List-Help: <mailto:mmusic-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/mmusic>, <mailto:mmusic-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 07 Apr 2016 19:55:03 -0000

On Thu, Apr 7, 2016 at 3:33 PM, Martin Thomson <martin.thomson@gmail.com>
wrote:

> On 7 April 2016 at 16:31, Roman Shpount <roman@telurix.com> wrote:
> > This is why you should discard hashes that you consider too weak. After
> you
> > done this, since any single hash match is sufficient, it does not matter
> in
> > what order the hashes are checked. If the weak hash is present, the
> session
> > will be accepted.
>
>
> I would argue that you should check all hashes that you support and
> are present.  Then, you can be protected against weaknesses that you
> aren't aware of.
>

Let me try to explain this again why this will not work. Consider that RTP
and RTCP can come from two different sources (devices) which will use
different DTLS associations for each component, use different certificates,
and potentially support different sets of hash functions. Because of this,
the fact that RTP device supports SHA-256 does not mean that RTCP will use
it or support it.

Regards,
______________
Roman Shpount

v2.23.0 | Report a Bug | By Email