Re: [saag] [Cfrg] Further MD5 breaks: Creating a rogue CA certificate

["Richard Graveman" <[e-mail]>]

Ran,

> It would be very helpful if a *set* of mathematicians/cryptographers
> could jointly put together a summary of the known attacks on all
> the widely used hash algorithms (e.g. MD2, MD4, MD5, SHA-0, SHA-1,
> SHA-2, others), *including references to the published literature*.

For an expert, authoritative, and incredibly up-to-date tutorial on
the state of hash functions, go to http://www.inscrypt.cn/, get the
invited talks, and see the one by Preneel. If the intro material is
boring, flip to slide 45 and start reading. No, MD5 and SHA-1 are not
quite in the same boat.

For full papers, see IACR eprints 2008/391 for MD5, 2008/469 for
SHA-1, and 2006/187 for HMAC with these. Follow the references
therein. I avoided sources that cost money to get to, etc.

Unfortunately, the ways cryptologists look at these things and the
ways the IETF uses them are not always the same, so there is more work
to do. Suffice it to say, for a start, there is a big difference
between, say:

1. An HMAC based on a fresh key used by IPsec of TLS for a few minutes.
2. An HMAC based on a key stuck in a router and keft there for months or years.
3. A hash used to sign an email.
4. A hash use to sign a root certificate.

Rich Graveman
_______________________________________________
saag mailing list
[e-mail]
https://www.ietf.org/mailman/listinfo/saag