Re: [OPSEC] minutes part 2

["Vishwas Manral" <[e-mail]>]

Hi Ran,

Great to hear you back. Hope you had a good holiday.

I will reply to your earlier questions about the SHA algorithm as well
as the other mails you have replied to. I have worked over the
questions you raised as well as talked to cryptographers as well as
the AD's for the same.

> On  23 Dec 2008, at 18:56, Vishwas Manral wrote:
>>
>> "Regardless of use, NIST encourages application and protocol designers
>> to use the SHA-2 family of hash functions for all new applications and
>> protocols."
>
> That is a policy statement, not a claim that it is safe to use.
>
> NIST are required by US law to recommend *something* for
> US agencies to use, and SHA-2 has the largest raw key size
> of NIST's (currently quite limited) choices.
That is good. So we agree that NIST atleast encourages the protocol
designers to use the algorithms. :) We probably also agree that there
is cutomer request for the use of the SHA algorithms as has been
brought out by others too.

I have been following the NIST development of the new protocol and it
is very well known inside the community  that any new algorithm to
replace SHA will be deployable only 10 years or so later. So I agree
its a good aim to have to use the algorithms that come out of the
selection process, the process itself may take a few years to get
through.

Regarding the talk of SHA algorithm having issues are correct however
after talking to cryptographers who have evaluated the current attacks
- it seems clear to them that MD5 strength is considerably lesser than
the SHA algorithm strengths. I will send you the details in another
mail. I have already shared the same with the WG chair.

It also seems clear from talks with the AD's that MD5 is not
recommended in any form for any cryptographic use - it is however
still not the case for SHA algorithm.

Thanks,
Vishwas

> However, NIST ARE working to deprecate SHA -- visible via
> the process described on their web site.  That process
> is entirely analogue to the process NIST used to replace
> DES with AES -- public submission period, public review
> period, and so forth.
>
>>> "The SHA-2 family of hash functions may be used by Federal agencies
>>> for all applications using secure hash algorithms."
>>>
>>> "Federal agencies should stop using SHA-1 for digital signatures,
>>> digital time stamping, and other applications that require
>>> collision resistance as soon as practical..."
>>
>> I am sorry to use the term safe. My intent was to state that SHA-1 has
>> been mandated to be not used for particular applications, while .SHA-2
>> family is encouraged for use by protocol designers.
>>
>> Are we on the same page regarding this or not?
>
> I don't know what your view is.
>
> NIST says that there are "serious attacks" on the
> SHA family and NIST is actively working to deprecate
> the SHA family (replacing it with something else).
>
> So there is NOT scientific reason to believe that the
> SHA family is stronger *as used in IGP authentication*
> than some other algorithm -- nor is there reason to
> believe some other algorithm is stronger than SHA given
> what we know right now.
>
> What would help here is a scientific paper comparing
> A and B formally and reaching some conclusion(s),
> a refereed openly published paper that everyone here
> can read.
>
> Cheers,
>
> Ran
> [e-mail]
>
_______________________________________________
OPSEC mailing list
[e-mail]
https://www.ietf.org/mailman/listinfo/opsec