Re: [OSPF] OSPF WG Last Call for OSPFv2 HMAC-SHA Cryptographic Authentication - <draft-ietf-ospf-hmac-sha-04.txt>

["Bhatia, Manav (Manav)" <[e-mail]>]

Hi John,

Thanks for the review! 

> > Good to see this work finally moving forward. I strongly support  
> > this once the following two issues are taken care of:
> >
> > (a) Draft cites HMAC-SHA-256, and not HMAC-SHA-1, as a MUST. Any  
> > specific reasons?
> 
> HMAC-SHA-1 is "So 1997"... The authors reached agreement on a  
> stronger common algorithm. Ran or one of the other authors may want  
> to comment on HMAC-SHA-1 vulnerabilities as there was a lengthy  
> discussion on which algorithm(s) to make a "MUST".
> 

The search space for SHA1 collisions is getting quite smaller. One can read more about it on http://eurocrypt2009rump.cr.yp.to/837a0a8086fa6ca714249409ddfae43d.pdf

Though this does not directly affect HMAC-SHA1, there have been other papers about attacks on SHA1 when used with the HMAC construct (http://eprint.iacr.org/2006/319.pdf). Please note that these attacks don't necessarily result in direct vulnerabilities in HMAC-SHA1 as used in the routing protocols for authentication purposes (RFC 4822, RFC 5310), because the colliding message may not necessarily be a syntactically correct protocol packet. However, we reasoned that if the WG wanted to mandate one particular authentication algorithm then it must be something stronger and more secure than HMAC-SHA1, and so HMAC-SHA-256 was chosen. 

Cheers, Manav

--
Manav Bhatia,
IP Division, Alcatel-Lucent,
Bangalore - India