Re: [OPSEC] minutes part 2

["Vishwas Manral" <[e-mail]>]

Hi Ran,

> Of course, NIST's approved algorithms list only contains
> NIST algorithms  This ought not be surprising.
>
> Of course, non-NIST algorithms aren't on NIST's lists.
> That is a tautology.
>
> There is no news here.
I am not trying to disseminate news here. The aim was to show that the
link which has been updated 2 months back states the uses of SHA-2,
etc is safe for hashing purposes.

I wanted to know if you thought that information was not correct.

Thanks,
Vishwas

> It is all entirely consistent with my prior statements.  There
> are some organisations that *for policy reasons* prefer to use
> certain algorithms or algorithm families.
>
> A choice made to comply with (local or national) organisational
> policy is quite different from a claim that scientific
> evidence exists that one algorithm is better than some
> other algorithm (when evaluated in the context of a
> particular cryptographic mode -- comparing apples to apples).
>
> As the IETF is an international, global organisation,
> the IETF has so far declined to use *local or national
> policy* as the basis to endorse or reject any particular
> algorithm.  This seems only proper as the IETF ought not
> prefer US policy over another country's policy in its
> decision making.  This principle of using global scope for
> the IETF standards processes lies behind [RFC-1984].
>
> Given the relatively recent information indicating "serious
> attacks" on SHA (the quote is from NIST [1]), including an
> acknowledged attack on SHA-1 [2], previous beliefs that SHA
> might be stronger are no longer supported by the science at hand.
> MD5 is also subject to "serious attacks" that have been published.
> So the data available says that both SHA and MD5 have cause
> for serious concern.
>
> Now, maybe someone has recently published some scientific,
> peer-reviewed, paper that compares MD5 and SHA (in the mode
> used by the IGPs for authentication).  If such exists, a pointer
> to that paper would be helpful to everyone in the OPsec WG.
> Absent such a paper, the only *scientific* conclusion is that
> (1) there is cause for concern about both SHA and MD5 and
> (2) there is not enough data at the present time to prefer
> either of those algorithms over the other algorithm.
>
> A practical step might be for some folks (not including me !)
> to add some additional MAC algorithms to the set available
> for IGP authentication, to provide more choices to implementers.
> Apparently specifications for an AES-CBC MAC and a "Counter
> with CBC-MAC" have been created in recent years. [RFC-3566]
> [RFC-3610]  (NOTE WELL:  I haven't done a literature search
> on either of those, so I'm not recommending either one; instead,
> I am only noting that the universe is not limited to SHA or MD5,
> and providing some examples of other options by way of an
> existence proof.)
>
> Cheers,
>
> Ran
> [e-mail]
>
> PS:  The set of "First Round Candidates" to replace
> the existing SHA standards are listed at reference [3] below.
>
> [1]<http://csrc.nist.gov/groups/ST/hash/index.html>
> [2]<http://csrc.nist.gov/groups/ST/toolkit/documents/shs/NISTHashComments-final.pdf>
> [3]<http://csrc.nist.gov/groups/ST/hash/sha-3/Round1/submissions_rnd1.html>
> _______________________________________________
> OPSEC mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/opsec
>
_______________________________________________
OPSEC mailing list
[e-mail]
https://www.ietf.org/mailman/listinfo/opsec