Re: [OPSEC] minutes part 2

On  29 Dec 2008, at 16:16, Vishwas Manral wrote:
> That is good. So we agree that NIST atleast encourages the protocol
> designers to use the algorithms. :)

Well, your words above are not what I said.

NIST prefers SHA-2 over other shorter forms of SHA,
probably because NIST (for now) can only recommend SHA
(as it is the only NIST hashing algorithm), NIST have
to recommend *something*, and SHA-2 has the longest
key size.

> We probably also agree that there
> is cutomer request for the use of the SHA algorithms as has been
> brought out by others too.

I'm the one who started the whole effort on SHA for IGPs,
just as I'm the one who started the whole effort to add
cryptographic authentication to IGPs last decade.
Having SHA as an option is sensible because it solves
a *policy* problem for some US Government users, including
some parts of DoD.  This was all covered in my past IETF
presentations.

> I have been following the NIST development of the new protocol and it
> is very well known inside the community  that any new algorithm to
> replace SHA will be deployable only 10 years or so later.

I disagree with your 10 year assessment.  AES deployed MUCH
MUCH more rapidly, after following a similar process for
public submission, public review, etc.  The IPsec magic
number for AES was allocated by IANA shortly after the AES
selection was announced by NIST, and there were interoperable
implementations of AES-CBC for IPsec ESP shortly after that
(even before the I-D appeared, as I recall).

> Regarding the talk of SHA algorithm having issues are correct however
> after talking to cryptographers who have evaluated the current attacks
> - it seems clear to them that MD5 strength is considerably lesser than
> the SHA algorithm strengths. I will send you the details in another
> mail. I have already shared the same with the WG chair.

I've consistently asked for a peer reviewed paper.
I like Hugo, but an email containing another person's
opinion is not a peer-reviewed paper.

Mind, such paper ought to be about the algorithms *in the modes
used for IGPs* since the matter at hand is IGPs.

If someone has done some formal maths and published it,
in some peer reviewed forum, please provide a citation
(or URL or something) to that paper so everyone can read it.

Hugo publishes from time to time, if he has published on
this, it would be helpful if he'd provide the full
citation (a URL to the paper would also be nice).

> It also seems clear from talks with the AD's that MD5 is not
> recommended in any form for any cryptographic use - it is however
> still not the case for SHA algorithm.

Thanks, but I'll wait for whichever ADs you mean above
to speak directly for themselves.

(Aside: MD5 was never a NIST algorithm; it isn't a surprise
to me that NIST hasn't recommended a non-NIST algorithm
for any uses.)

Cheers,

Ran
rja@extremenetworks.com

_______________________________________________
OPSEC mailing list
OPSEC@ietf.org
https://www.ietf.org/mailman/listinfo/opsec