Re: [secdir] secdir review of draft-baeuerle-netnews-cancel-lock-05

[David Mandelberg <[e-mail]>]

On 06/28/2017 12:09 PM, Michael Bäuerle wrote:
> David Mandelberg wrote:
>>
>> [...]
>> This document recommends calculating a single key K for each article
>> (section 4), then publishing base64(hash(base64(K))) values for multiple
>> different hash algorithms. This means that the preimage resistance of
>> the weakest hash algorithm places an upper bound on the security of the
>> authentication, even if the receiver ignores weaker algorithms. (An
>> attacker who can calculate K from the weak hash can generate valid keys
>> for the stronger hashes.)
> 
> The option to add multiple entries with different hash algorithms in
> the new draft is intended for the transition period. SHA1 (as defined
> in the old draft from Simon Lyall) was used for decades and it is
> unlikely that all existing implementations will add SHA2 support
> quickly.
> 
>> Additionally, while plenty of research goes
>> into preimage security of individual hash algorithms, I don't think as
>> much research goes into preimage security of multiple algorithms used in
>> parallel on the same input. While I don't know of any non-brute-force
>> attacks that can find X given sha256(X) and sha512(X), I see no reason
>> that it wouldn't be easier than the easiest of the two individual
>> preimage attacks. (I am not an expert though, there might be something
>> I'm missing.)
> 
> Suggested additional words for Section 4 (Calculating the key data):
> 
>   In general every agent must not use the same secret <sec> if
>   multiple <c-lock> elements are added.

Section 4 is only a RECOMMENDED way to calculate K, so I don't think
adding anything to section 4 is sufficient. I'd suggest adding something
to section 2.1 like: "If multiple <c-lock> are present in a
<c-lock-list>, each <c-lock> MUST use a unique key K." Adding text to
Section 4 would be good too though.


-- 
David Eric Mandelberg / dseomn
http://david.mandelberg.org/