[Tm-rid] Pre-image attack against HHIT generation

[Robert Moskowitz <[e-mail]>]

One item that came up in the BOF was the risk of a pre-image attack 
against HHIT generation.

With only 64 bits in the hash, there is a real concern that the attacker 
can use some bank of GPUs to make lots of x25519 key pairs until getting 
one that hashes to an observed HHIT and impersonate it.

First this attack is marginalized in that the HIT is used to retrieve a 
DNS HIP RR to get the real registered HI. Then the attackers signed auth 
message fails Sec 4.1 & 4.2 of draft-wiethuechter-tmrid-auth-02.txt .  
Further, in the no Internet mode and HDA signed object in Sec 4.3 of 
draft-wiethuechter-tmrid-auth-02.txt cannot be provided by the UA.

But this is an important item that I have to cover in the Security 
section of the HHIT draft.  Thus I am looking for help in references to 
timing to generate a key pair.  How does a preimage attack in this 
environment work?  Is there some shortcut where the attacker need not 
generate 700M EC pairs until it creates a collision? Please provide 
references and timings.

Then what if the hash is enlarged from 64 bits to 66? 68?  How big to 
have a longer attack time today?  And then how long would it take in 5 
years from now?  That is, is it worth increasing the hash size to get 
greater preimage attack protection because the attacking will NOT get 
earier in n years.

Perhaps a bit of rambling up there, but I do need to include good 
information on this in the security section.

Bob