Re: [secdir] Secdir review of draft-turner-md2-to-historic-05

[Catherine Meadows <[e-mail]>]

Sean,

Yes, this looks much better, although I think that for

Since its publication, MD2 has been shown to not be collision-free
[ROCH1995][KNMA2005][ROCH1997], albeit successful pre-image attacks
for properly implement MD2 are not that damaging. 

what you really meant to say was

Since its publication, MD2 has been shown to not be collision-free
[ROCH1995][KNMA2005][ROCH1997], albeit successful collision  attacks
for properly implemented MD2 are not that damaging. 

Is that correct?

Cathy

On Oct 18, 2010, at 3:02 PM, Sean Turner wrote:

> Catherine,
> 
> Thanks for your review.
> 
> How about I make the following two changes:
> 
> 1) In Section 1, add something to provide a better characterization of the collision-resistance:
> 
> OLD:
> 
> Since its publication, MD2 has been shown to not be collision-free
> [ROCH1995][KNMA2005][ROCH1997] and shown to have successful
> pre-image attacks [KNMA2005][MULL2004][KMM2010].
> 
> NEW:
> 
> Since its publication, MD2 has been shown to not be collision-free
> [ROCH1995][KNMA2005][ROCH1997], albeit successful pre-image attacks
> for properly implement MD2 are not that damaging. MD2 has also been
> shown to have successful pre-image and second-preimage attacks
> [KNMA2005[MULL2004][KMM2010].
> 
> 2) In section 6, align the last sentence of the second paragraph and the 1st sentence of paragraph 3:
> 
> OLD:
> 
> .., which is not significantly better than the birthday attack.
> 
> Even though collision attacks on MD2 are not more powerful than
> the  birthday attack, MD2 was found not to be one-way...
> 
> NEW:
> 
> .., which is not significantly better than the birthday attack.
> 
> Even though collision attacks on MD2 are not significantly more
> powerful than the birthday attack, MD2 was found not to be
> one-way...
> 
> spt
> 
> On 10/16/10 2:36 PM, Catherine Meadows wrote:
>> I have reviewed this document as part of the security directorate's
>> ongoing effort to review all IETF documents being processed by the
>> IESG.  These comments were written primarily for the benefit of the
>> security area directors.  Document editors and WG chairs should treat
>> these comments just like any other last call comments.
>> 
>> 
>> This document recommends that the MD2 hash algorithm be moved to historic status and gives
>> the rationale for doing this.  The reasons are mainly security-related, given that the algorithm
>> has been shown not to be collision-free and is vulnerable to pre-image attacks.  Performance is also an
>> issue.  The impact is minimal, given that support for MD2 in the standards that refer to it is either optional or
>> discouraged.
>> 
>> I have no problems with the decision or rationale.  I agree, as I am sure that everyone else does, the MD2
>> should be retired.
>> 
>> I do have one minor recommendation though about the rationale: in section 2 (the Rationale section),
>> you say that MD2 has been shown to not be collision-free and is vulnerable to pre-image attacks.  The Rationale
>> appears to give both these concerns equal value. But in Section 6 (Security Considerations), you say
>> that the most successful collision attacks against MD2 are not significantly better than the birthday attack,
>> and the real security problems with MD2 have to do with its vulnerability to pre-image attacks.  It seems to me that
>> this reasoning should be reflected in the Rationale.
>> 
>> 
>> Catherine Meadows
>> Naval Research Laboratory
>> Code 5543
>> 4555 Overlook Ave., S.W.
>> Washington DC, 20375
>> phone: [phone]
>> fax: [phone]
>> email: [e-mail]
>> 
>> _______________________________________________
>> secdir mailing list
>> [e-mail]
>> https://www.ietf.org/mailman/listinfo/secdir
>> 

Catherine Meadows
Naval Research Laboratory
Code 5543
4555 Overlook Ave., S.W.
Washington DC, 20375
phone: [phone]
fax: [phone]
email: [e-mail]