[Spasm] Consideration for MD5 as untrusted in RFC5751bis? (and related doc)

[Wei Chuang <[e-mail]>]

Hi everyone,

I wanted to bring more eyes to the proposal which is to treat MD5 digest as
untrusted in updates to  draft-schaad-rfc5751-bis-00.  Its been long
documented in RFC6151 which is from 2011 that "MD5 is no longer acceptable
where collision resistance is required such as digital signatures".  And
since then there have been real world examples where MD5 has been exploited
e.g. search for "Flame MD5".  Note when the exploit was posted, and
consider that compute power has substantially improved increasing the
accessibility of the exploit.  Consequently as we update RFC5751 we should
deprecate MD5 from the list of trusted algorithms.  We should similarly do
this for RFC5750 i.e. consider a RFC5750bis and deprecate MD5 there as well.

Now understandably there is the issue of backwards compatibility.  There
already is support in both documents for this as it specifies warning users
when RSA and DSA with keysize < 1024 is used.   It also differentiates
treatment of archived messages from newly received messages.   We should do
the same for MD5, and formalize this process for other future deprecations
of keylength and algorithms.  I further propose that language be adjusted
so sending agents must not use these deprecated algorithm or keysize.

Please provide your opinion / feedback as community opinion is very
important for this issue.

thanks very much,
-Wei