Re: [OPSEC] minutes part 2

Hi Joel/ Ran,

>> I object to the assertions in those minutes that:
>>     - the SHA approaches are better/stronger than MD5 approaches.
>>           [We have agreed that the evidence does NOT support such a
>>           claim -- which claim appears to be in the meeting minutes.]
>>
>>     - the WG should recommend/encourage/promote SHA approaches
>>           over MD5 approaches. [which claim again appears to be
>>           in the meeting minutes]
>
> Just as a point of order, I looked at the minutes and audio and I think
> their existence in the dialogue as stated in the minutes is accurate, if
> not work for word.
I find the following link for the approved algorithms for secure hashing:
http://csrc.nist.gov/groups/ST/toolkit/secure_hashing.html , they
include SHS algorithms but not MD5 ones. Though there is a line which
states that:

"After 2010, Federal agencies may use SHA-1 only for the following
applications: hash-based message authentication codes (HMACs); key
derivation functions (KDFs); and random number generators (RNGs).
Regardless of use, NIST encourages application and protocol designers
to use the SHA-2 family of hash functions for all new applications and
protocols."

MD5 is not amoung the approved algorithms for the same.

Ran, I would like to hear your views on the same.

Thanks,
Vishwas
_______________________________________________
OPSEC mailing list
OPSEC@ietf.org
https://www.ietf.org/mailman/listinfo/opsec