Re: [saag] Revision of "Attacks on Cryptographic Hashes in Internet Protocols"

["David McGrew (mcgrew)" <[e-mail]>]

Hi Joe and Paul,

On 11/13/12 5:16 PM, "Joe Touch" <[e-mail]> wrote:

>Hi, Paul (et al.),
>
>This doc refers to IETF protocols that use hashes, but doesn't discuss
>any in specific. It also doesn't address how hashes are used, e.g., solo
>(as a fingerprint), keyed (for authentication and source confirmation),
>as part of an HMAC, or as part of key derivation.
>
>That sort of information might be additionally useful, IMO.

I think you (Joe) have a valid point about how the draft could be
improved, though the draft does address the use question somewhat (it even
has a section on "How Internet Protocols Use Hash Algorithms").

I have a suggestion: the draft could

1) more precisely define the different ways that hash functions are used
in more detail (in signatures, in HMAC, KDFs, other message authentication
codes, integrity checking, ...)   The definitions should be clear enough
that a relative crypto novice, looking at a specification that describes a
use of a hash function, could correctly categorize that use.

2) relate the security of each use case to the collision/first
preimage/second preimage attacks

3) have a section that describes uses of hash functions in Internet
protocols that rely on collision resistance.   (My thinking here is that
there are many uses of hash functions, and so we should focus on the most
security critical cases)

If we had an RFC with these clear categories in them, then we could
categorize new uses of hash functions that appear in new drafts, perhaps
focusing on the cases where collision resistance is required.   This could
be part of the SECDIR review process, or perhaps some other independent
process (for instance, send an automatic message to the authors pointing
out the hash function in their draft and the categories in the RFC).
Yes, I realize that there are a lot of of RFC and drafts using hash
functions, and that this is a non-trivial amount of work. But consider how
much better off we would be now if we had started categorizing uses of
hash functions in RFCs back in y2k ...

What do you think?

David

>
>Joe
>
>On 11/8/2012 4:29 AM, Paul Hoffman wrote:
>> Greetings again. Bruce Schneier and I have started an update to RFC
>>4270, "Attacks on Cryptographic Hashes in Internet Protocols". This
>>revision is meant to deal with new and more devastating attacks on MD5,
>>the fact that SHA-1 collisions will be financially feasible in the
>>foreseeable future, and NIST's upcoming SHA-3 announcements. We expect
>>to keep this revision process open for at least five months because NIST
>>probably won't finalize the parameters and naming and so on for KECCAK
>>until then; that is, we won't send this to RFC Editor until SHA-3 is
>>finalized. Please take a look at
>>
>> http://tools.ietf.org/html/draft-hoffman-schneier-4270bis
>>
>> Sean and Stephen have agreed that we should use the SAAG mailing list
>>for discussing this draft.
>>
>> --Paul Hoffman
>> _______________________________________________
>> saag mailing list
>> [e-mail]
>> https://www.ietf.org/mailman/listinfo/saag
>>
>_______________________________________________
>saag mailing list
>[e-mail]
>https://www.ietf.org/mailman/listinfo/saag