Re: [saag] Improving the CHAP protocol

[Peter Gutmann <[e-mail]>]

I think many people in this thread are missing the purpose of the exercise.
CHAP is used because umpteen bajillion devices and systems need it, not
because it's a very good protocol.  It's insecure because it's CHAP, not
because it uses MD5.  Since it needs a one-way function, not a collision-
resistant function, any hash function is as good - or bad since CHAP isn't
very secure - as any other.  Switching from MD5 to polyquantumresistantind-
ccaprovable2048bithash will make no difference whatsoever to its security.

What the original poster asked for is something FIPS compliant.  If you want
to convince said umpteen bajillion devices to switch, you'd better use the
universal-standard FIPS-compliant hash algorithm that everything supports,
which is SHA-256, not a bunch of wierdo fashion-statement algorithms that
nothing supports, which is most of the other stuff that's been suggested.

Having said that, you'll have to accept that the vast majority of users will
keep going with MD5 more or less forever since there's no motive apart from
FIPS to change, so perhaps it'd be best to pitch the update RFC as "FIPS
compliance for CHAP" or something similar.

Peter.