Re: [saag] [Cfrg] Further MD5 breaks: Creating a rogue CAcertificate

Rich,

As your private e-mail states that item 4 below you see as most
dangerous.

That is not so.

The self-signed root and hash used to sign that root is not relevant to
security since the signature on self-signed certificates is gratuitous.

We do not want the community to undertake a major effort that is not
required at all and does nothing for security.

That said, one of the techniques (which is not a standardized one, but a
commercial practice) is to provide hash of the root certificate in a
secure out of band (e.g., manually) to verify the roots.  This mechanism
to compute the hash on the entire signed root certificate for out of
band trust establishment should be at least SHA-1 today and changed when
SHA-256 or new hash are widely deployed on the clients.  

-----Original Message-----
From: cfrg-bounces@irtf.org [mailto:cfrg-bounces@irtf.org] On Behalf Of
Richard Graveman
Sent: Wednesday, December 31, 2008 12:42 PM
To: RJ Atkinson
Cc: cfrg@irtf.org; saag@ietf.org
Subject: Re: [Cfrg] [saag] Further MD5 breaks: Creating a rogue
CAcertificate

Ran,

> It would be very helpful if a *set* of mathematicians/cryptographers
> could jointly put together a summary of the known attacks on all
> the widely used hash algorithms (e.g. MD2, MD4, MD5, SHA-0, SHA-1,
> SHA-2, others), *including references to the published literature*.

For an expert, authoritative, and incredibly up-to-date tutorial on
the state of hash functions, go to http://www.inscrypt.cn/, get the
invited talks, and see the one by Preneel. If the intro material is
boring, flip to slide 45 and start reading. No, MD5 and SHA-1 are not
quite in the same boat.

For full papers, see IACR eprints 2008/391 for MD5, 2008/469 for
SHA-1, and 2006/187 for HMAC with these. Follow the references
therein. I avoided sources that cost money to get to, etc.

Unfortunately, the ways cryptologists look at these things and the
ways the IETF uses them are not always the same, so there is more work
to do. Suffice it to say, for a start, there is a big difference
between, say:

1. An HMAC based on a fresh key used by IPsec of TLS for a few minutes.
2. An HMAC based on a key stuck in a router and keft there for months or
years.
3. A hash used to sign an email.
4. A hash use to sign a root certificate.

Rich Graveman
_______________________________________________
Cfrg mailing list
Cfrg@irtf.org
https://www.irtf.org/mailman/listinfo/cfrg
_______________________________________________
saag mailing list
saag@ietf.org
https://www.ietf.org/mailman/listinfo/saag