Subject: [MSEC] SHA-1 replacement analyses for MSEC protocols

From: Lakshminath Dondeti <[email-masked]>
Date: Wed, 16 Nov 2005 17:39:50 -0800

At the SAAG meeting, Russ directed all SEC area WGs to analyze the 
protocols they are working (worked) on and plan for SHA-1 
replacement.  Here are the directives (1) and (2):

"1.Do the Bellovin-Rescorla analysis before IETF 65 for each protocol 
in the WG"
"2.Start standards work for transition to SHA-256, but remember 
another transition is coming, so plan for it"

MSEC has the following documents/protocols to analyze:

GSAKMP
GDOI
MSEC-signatures
MIKEY related
TESLA

Did I miss any?

Our first request to everyone is to read the Belloving-Rescorla paper 
(the relevant NIST and SAAG presentations materials should help as 
well).  Feel free to discuss the analysis method and your review of 
that paper with other MSEC contributors.

References:
http://www.cs.columbia.edu/~smb/papers/new-hash.pdf
http://www.csrc.nist.gov/pki/HashWorkshop/2005/Oct31_Presentations/Bellovin_new-hash.pdf
https://datatracker.ietf.org/public/meeting_materials.cgi?meeting_num=64 
(search for SAAG meeting materials)

Next, if you are interested in analyzing any of the MSEC documents or 
protocols, please contact Ran and me.  Some of you have already done 
so; thanks.

We need to start work on this ASAP as we need to finish this work 
before the March IETF meeting,  **February 27, 2006 would be the -00- deadline

We'll post the protocol analysis assignments :-) toward the end of 
next week.  (Please hurry and volunteer).

thanks and regards,
Lakshminath

for
Ran & Lakshminath

PS:  Current document authors MUST do the analysis as part of their 
next document revision.  Thanks.

_______________________________________________
msec mailing list
[email-masked]
http://six.pairlist.net/mailman/listinfo/msec

---

From: Robert Moskowitz <[email-masked]>
Date: Thu, 17 Nov 2005 13:08:44 -0800

>replacement.  Here are the directives (1) and (2):

I would also like to point out NSA's 'Suite B' algorithms that will 
have a large impact on Diffie-Hellman based key exchanges.

Actually, it has a big impact on ANY key exchange; at least based on 
analyses that I have seen.

Vendors may find themselves doing one set of suites for govs, and 
another for commerce unless they either license some ECC patents, or 
we get further clearification on NSA's purchase of rights to said patents.

Robert Moskowitz
ICSAlabs/A Division of TruSecure Corporation
Security Interest EMail: [email-masked]

---

From: George Gross <[email-masked]>
Date: Thu, 17 Nov 2005 21:05:07 -0500 (EST)

Hi Bob,

> have a large impact on Diffie-Hellman based key exchanges.

I infer that these are ECC-based DH algorithms? do you have a web pointer
to a reference for "Suite B" in the public domain?

> analyses that I have seen.

So far, the IETF focus has been on MD5 and SHA1 replacement. Is it your
contention that the scope should be widened to replace classic
Diffie-Hellman key agreement in IETF standards?

Doing a migration to DH++, if needed, could be piggybacked onto the
SHA1->SHA-256 and 3DES->AES migrations. But if we're serious about that,
then it needs to get worked in parallel in IPsec working group, not just
here in MSEC... i.e. the larger IETF community would need to buy in.

local to MSEC, AFAIK all of the current standards track protocols use
Diffie-Hellman in their registration SA phase...

> we get further clearification on NSA's purchase of rights to said patents.

yuck. sounds like we're overdue for a crypto suite that eclipses classic
DH yet does not have IPR encumberances ;o( are there any such
alternatives?

br,
	George