Re: [saag] Improving the CHAP protocol

[Maurizio Lombardi <[e-mail]>]

Hello Peter,

Dne 21.9.2019 v 19:35 Peter Gutmann napsal(a):
> I think many people in this thread are missing the purpose of the exercise.
> CHAP is used because umpteen bajillion devices and systems need it, not
> because it's a very good protocol.  It's insecure because it's CHAP, not
> because it uses MD5.  Since it needs a one-way function, not a collision-
> resistant function, any hash function is as good - or bad since CHAP isn't
> very secure - as any other.  Switching from MD5 to polyquantumresistantind-
> ccaprovable2048bithash will make no difference whatsoever to its security.
> 
> What the original poster asked for is something FIPS compliant.  If you want
> to convince said umpteen bajillion devices to switch, you'd better use the
> universal-standard FIPS-compliant hash algorithm that everything supports,
> which is SHA-256, not a bunch of wierdo fashion-statement algorithms that
> nothing supports, which is most of the other stuff that's been suggested.

That's correct, what we need is just a FIPS-compliant hash function
that is very unlikely do be deprecated anytime soon; and we need it
because the non-compliance of MD5 is breaking iSCSI use cases for our customers now.

The collision resistance of the hash function is not a top priority for us.

Personally, I would like to see adopted something widely used,
SHA-256 and SHA3-256 are good candidates IMO.

Maurizio Lombardi