[saag] attacks on keyed-hash constructions [was: Re: [cfrg] Further MD5 breaks: Creating a rogue CA certificate]

[David McGrew <[e-mail]>]

Hi Ran,

On Jan 5, 2009, at 5:26 AM, RJ Atkinson wrote:

>
> On  5 Jan 2009, at 04:57, der Mouse wrote:
>> What I, as an amateur, take away from it is approximately "MD5 is
>> showing more and more cracks and nobody should use it for anything  
>> that
>> needs to withstand a malicious adversary".
>
> Within the CA world, many folks here seem to agree.
>
> However, the usage in CAs is rather different from
> some other modes of operation (e.g. Keyed-Hash, HMAC-Hash).
>
> So far, there are no known attacks on those other modes of operation.
> [If someone knows of a refereed paper that's been published
> on those latter topics, please share a citation here.]

I'm not sure what you mean by keyed-hash, but here are some attacks  
that might be relevant.

[1] B. Preneel and P. van Oorschot, “MD-x MAC and building fast MACs  
from hash
functions,” Advances in Cryptology – Crypto 95 Proceedings, Lecture  
Notes in Computer
Science Vol. 963, D. Coppersmith ed., Springer-Verlag, 1995.

[2] B. Preneel and P. van Oorschot, “On the security of two MAC  
algorithms,” Advances
in Cryptology – Eurocrypt 96 Proceedings, Lecture Notes in Computer  
Science Vol. ??,
U. Maurer ed., Springer-Verlag, 1996.

RFC 2385 uses the method broken in Section 4.2 of [1].

HMAC seems to be secure given some reasonable assumptions about the  
hash functions (namely, that the underlying hash has a compression  
function that is a PRF - no collision resistance is required); see http://eprint.iacr.org/2006/043

>
>
>> These may be the best openly published breaks of MD5 at the moment,
>
> Mind, there are published "serious attacks" [using NIST's words
> from their web site] against SHA-0 and SHA-1 also.   Timothy
> Miller seemed to suggest in recent email that perhaps the PKIX WG
> might enhance the CA structure to increase attack resistance in an
> algorithm-independent way.
>
> Now, may I suggest that folks please LOOK AT and possibly
> REDUCE/EDIT the CC line as they reply to this thread going forward.
> Items that are PKIX specific likely belong only on the PKIX
> list.  Ditto for SMIME specific issues to the SMIME list.
> That would leave only generic comments for the SAAG list.
>

Done.

David

_______________________________________________
saag mailing list
[e-mail]
https://www.ietf.org/mailman/listinfo/saag