Re: [OPSEC] draft-bhatia-manral-igp-crypto-requirements

Vishwas Manral wrote:
> Hi Glen,
> 
> Thanks for your support of the document.
> 
> There was no ambiguity as such, however Ran wanted us to look further
> into whether the recently announced vulnerabilities to SHA-1 and MD5
> would effect the reccomendation for HMAC-SHA-1.

We have the issue of vulnerable today vs problematic today, or
tomorrow... I feel very comfortable saying there are some places where
md5 is used today that I'd really prefer to not be using it in 5 years.

That's good advice to have especially on the operational side.

stating that is being proactice.

joelja

> Thanks,
> Vishwas
> 
> On Tue, Feb 24, 2009 at 9:04 AM, Glen Kent <glen.kent@gmail.com> wrote:
>> So was there any ambiguity in recommending HMAC-SHA1 over other
>> available options ever?
>>
>> I re-read the document, found it extremely simple, the recommendations
>> look right, found it just to be what OPSEC must own up.
>>
>> Glen
>>
>> On Tue, Feb 24, 2009 at 9:39 AM, Vishwas Manral <vishwas.ietf@gmail.com> wrote:
>>> Hi folks,
>>>
>>> We now have got some clear guidance regarding this document from the
>>> Security AD's regarding the cryptographic algorithms (Joel has been
>>> privy to those mails). The guidance seems to second what Hugo and
>>> other cryptographers have been stating all along. The crux of what has
>>> been said is:
>>>
>>> MD5 should not be used for crypto purposes. SHA-1 though stronger is
>>> also vulnerable. HMAC-MD5 though not yet vulnerable looks highly
>>> suspect and should not be reccomended. HMAC-SHA-1 for now looks ok and
>>> can be reccomended. Goinf forward we should try to reccomend the SHA-2
>>> family of protocols.
>>>
>>> With these clear guidances matching what we have in our documents, I
>>> would like to ask the working group to look into this document
>>> further. We can then look at getting this as a WG document.
>>>
>>> Thanks,
>>> Vishwas
>>> _______________________________________________
>>> OPSEC mailing list
>>> OPSEC@ietf.org
>>> https://www.ietf.org/mailman/listinfo/opsec
>>>
> _______________________________________________
> OPSEC mailing list
> OPSEC@ietf.org
> https://www.ietf.org/mailman/listinfo/opsec
> 