Re: [saag] Improving the CHAP protocol

FIPS is one advantage. The other is that MD5 is getting scarce in crypto libraries, while SHA-256 is everywhere.  Not everything is devices — there’s still software out there.

But yes, it’s still CHAP.

> On 21 Sep 2019, at 20:35, Peter Gutmann <pgut001@cs.auckland.ac.nz> wrote:
> 
> I think many people in this thread are missing the purpose of the exercise.
> CHAP is used because umpteen bajillion devices and systems need it, not
> because it's a very good protocol.  It's insecure because it's CHAP, not
> because it uses MD5.  Since it needs a one-way function, not a collision-
> resistant function, any hash function is as good - or bad since CHAP isn't
> very secure - as any other.  Switching from MD5 to polyquantumresistantind-
> ccaprovable2048bithash will make no difference whatsoever to its security.
> 
> What the original poster asked for is something FIPS compliant.  If you want
> to convince said umpteen bajillion devices to switch, you'd better use the
> universal-standard FIPS-compliant hash algorithm that everything supports,
> which is SHA-256, not a bunch of wierdo fashion-statement algorithms that
> nothing supports, which is most of the other stuff that's been suggested.
> 
> Having said that, you'll have to accept that the vast majority of users will
> keep going with MD5 more or less forever since there's no motive apart from
> FIPS to change, so perhaps it'd be best to pitch the update RFC as "FIPS
> compliance for CHAP" or something similar.
> 
> Peter.
> 
> _______________________________________________
> saag mailing list
> saag@ietf.org
> https://www.ietf.org/mailman/listinfo/saag