Subject: [Hipsec] Digital Signature Algorithms

From: [email-masked] (Henderson, Thomas R)
Date: Thu Oct 21 13:12:01 2004

> -----Original Message-----
> From: Pekka Nikander [mailto:[email-masked]]=20
> Sent: Thursday, October 21, 2004 10:36 AM
> To: Henderson, Thomas R
> Cc: [email-masked]
> Subject: Re: [Hipsec] Digital Signature Algorithms
>=20
>=20
> > My only point on that outline was that, unless there was some
> > negotiation extension, it would be difficult to move away from
> > DSA or RSA in opportunistic mode in the future, while maintaining
> > backward compatibility.  Maybe this is obvious, but I was just
> > pointing out the implication.
>=20
> I see.  But, if we need to move away from DSA or RSA for
> security reasons, I'm afraid that we can't maintain backward
> compatibility.  Independent of what kind of a negotiation
> mechanism you would have, you would be vulnerable to
> bidding-down attacks.

good point.

>=20
> Maybe we should add a paragraph to the security considerations
> section:
>=20
>     If an initiator wants to use opportunistic mode, it is
>     vulnerable to man-in-the-middle attacks.  Furthermore,
>     the available HI types are limited to the MUST implement
>     algorithms, as per <xref target=3D"XXX">.  Hence, if a future
>     specification deprecates the current MUST implement algorithm(s)
>     and replaces it (them) with some new one(s), backward=20
> compatibility
>     cannot be preserved.  However, given the generally insecure
>     nature of the opportunistic mode, this is not considered to
>     be a serious problem.
>=20

I would delete the last sentence (opportunistic is not "generally
insecure" although it has a specific security vulnerability),=20
otherwise I would support adding that paragraph.

Tom =20