Re: [OPSEC] minutes part 2

Folks,

Of course, NIST's approved algorithms list only contains
NIST algorithms  This ought not be surprising.

Of course, non-NIST algorithms aren't on NIST's lists.
That is a tautology.

There is no news here.

It is all entirely consistent with my prior statements.  There
are some organisations that *for policy reasons* prefer to use
certain algorithms or algorithm families.

A choice made to comply with (local or national) organisational
policy is quite different from a claim that scientific
evidence exists that one algorithm is better than some
other algorithm (when evaluated in the context of a
particular cryptographic mode -- comparing apples to apples).

As the IETF is an international, global organisation,
the IETF has so far declined to use *local or national
policy* as the basis to endorse or reject any particular
algorithm.  This seems only proper as the IETF ought not
prefer US policy over another country's policy in its
decision making.  This principle of using global scope for
the IETF standards processes lies behind [RFC-1984].

Given the relatively recent information indicating "serious
attacks" on SHA (the quote is from NIST [1]), including an
acknowledged attack on SHA-1 [2], previous beliefs that SHA
might be stronger are no longer supported by the science at hand.
MD5 is also subject to "serious attacks" that have been published.
So the data available says that both SHA and MD5 have cause
for serious concern.

Now, maybe someone has recently published some scientific,
peer-reviewed, paper that compares MD5 and SHA (in the mode
used by the IGPs for authentication).  If such exists, a pointer
to that paper would be helpful to everyone in the OPsec WG.
Absent such a paper, the only *scientific* conclusion is that
(1) there is cause for concern about both SHA and MD5 and
(2) there is not enough data at the present time to prefer
either of those algorithms over the other algorithm.

A practical step might be for some folks (not including me !)
to add some additional MAC algorithms to the set available
for IGP authentication, to provide more choices to implementers.
Apparently specifications for an AES-CBC MAC and a "Counter
with CBC-MAC" have been created in recent years. [RFC-3566]
[RFC-3610]  (NOTE WELL:  I haven't done a literature search
on either of those, so I'm not recommending either one; instead,
I am only noting that the universe is not limited to SHA or MD5,
and providing some examples of other options by way of an
existence proof.)

Cheers,

Ran
rja@extremenetworks.com

PS:  The set of "First Round Candidates" to replace
the existing SHA standards are listed at reference [3] below.

[1]<http://csrc.nist.gov/groups/ST/hash/index.html>
[2]<http://csrc.nist.gov/groups/ST/toolkit/documents/shs/NISTHashComments-final.pdf 
 >
[3]<http://csrc.nist.gov/groups/ST/hash/sha-3/Round1/submissions_rnd1.html 
 >
_______________________________________________
OPSEC mailing list
OPSEC@ietf.org
https://www.ietf.org/mailman/listinfo/opsec