Re: [OPSEC] minutes part 2

["Vishwas Manral" <[e-mail]>]

Hi Ran,

I will deal with the two topics in seperate mails.
>> That is good. So we agree that NIST atleast encourages the protocol
>> designers to use the algorithms. :)
>
> Well, your words above are not what I said.
>From the NIST site and has been shared earlier with you (I am just
quoting what NIST states on its web site which has been updated 2
months back):

"Regardless of use, NIST encourages application and protocol designers
to use the SHA-2 family of hash functions for all new applications and
protocols."

Thanks,
Vishwas


> NIST prefers SHA-2 over other shorter forms of SHA,
> probably because NIST (for now) can only recommend SHA
> (as it is the only NIST hashing algorithm), NIST have
> to recommend *something*, and SHA-2 has the longest
> key size.
>
>> We probably also agree that there
>> is cutomer request for the use of the SHA algorithms as has been
>> brought out by others too.
>
> I'm the one who started the whole effort on SHA for IGPs,
> just as I'm the one who started the whole effort to add
> cryptographic authentication to IGPs last decade.
> Having SHA as an option is sensible because it solves
> a *policy* problem for some US Government users, including
> some parts of DoD.  This was all covered in my past IETF
> presentations.
>
>> I have been following the NIST development of the new protocol and it
>> is very well known inside the community  that any new algorithm to
>> replace SHA will be deployable only 10 years or so later.
>
> I disagree with your 10 year assessment.  AES deployed MUCH
> MUCH more rapidly, after following a similar process for
> public submission, public review, etc.  The IPsec magic
> number for AES was allocated by IANA shortly after the AES
> selection was announced by NIST, and there were interoperable
> implementations of AES-CBC for IPsec ESP shortly after that
> (even before the I-D appeared, as I recall).
>
>> Regarding the talk of SHA algorithm having issues are correct however
>> after talking to cryptographers who have evaluated the current attacks
>> - it seems clear to them that MD5 strength is considerably lesser than
>> the SHA algorithm strengths. I will send you the details in another
>> mail. I have already shared the same with the WG chair.
>
> I've consistently asked for a peer reviewed paper.
> I like Hugo, but an email containing another person's
> opinion is not a peer-reviewed paper.
>
> Mind, such paper ought to be about the algorithms *in the modes
> used for IGPs* since the matter at hand is IGPs.
>
> If someone has done some formal maths and published it,
> in some peer reviewed forum, please provide a citation
> (or URL or something) to that paper so everyone can read it.
>
> Hugo publishes from time to time, if he has published on
> this, it would be helpful if he'd provide the full
> citation (a URL to the paper would also be nice).
>
>> It also seems clear from talks with the AD's that MD5 is not
>> recommended in any form for any cryptographic use - it is however
>> still not the case for SHA algorithm.
>
> Thanks, but I'll wait for whichever ADs you mean above
> to speak directly for themselves.
>
> (Aside: MD5 was never a NIST algorithm; it isn't a surprise
> to me that NIST hasn't recommended a non-NIST algorithm
> for any uses.)
>
> Cheers,
>
> Ran
> [e-mail]
>
>
>
> _______________________________________________
> OPSEC mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/opsec
>
_______________________________________________
OPSEC mailing list
[e-mail]
https://www.ietf.org/mailman/listinfo/opsec