Subject: MD5 warning

From: David Shaw <[email-masked]>
Date: Fri, 20 Aug 2004 11:35:49 -0400

With regards to reinstating TIGER, I agree that there is little need
to do anything in crisis mode.  Let's give the various discussions
about MD5 and general hash health time to reach some sort of
conclusion.  We already have quite a number of hashes other than MD5,
and in V4, SHA-1 is the standard hash anyway.  Despite various rumors
to the contrary, SHA-1 was not broken.

That said, the security considerations section of the draft currently
has some language mildly discouraging the use of MD5 ("The MD5 hash
algorithm has been found to have weaknesses (pseudo-collisions in the
compress function) that make some people deprecate its use.  They
consider the SHA-1 algorithm better.")  Can we make this stronger, and
deprecate MD5 use for OpenPGP in general?

David

---

From: Lutz Donnerhacke <[email-masked]>
Date: Sat, 21 Aug 2004 21:23:13 +0000 (UTC)

> deprecate MD5 use for OpenPGP in general?

Not necessary. All known attacks does not impose a direct risk to md5 based
OpenPGP issues.

---

From: David Shaw <[email-masked]>
Date: Sat, 21 Aug 2004 17:54:43 -0400

> Not necessary. All known attacks does not impose a direct risk to md5 based

True, but would you recommend using MD5 these days?  The time to
deprecate it is before it is completely broken, and the attacks do
pose a direct risk.

MD5 showed some signs of weakness a few years ago.  A few days ago, it
showed some pretty serious problems.  Let's let it go now while it is
relatively easy to do so.

To put my suggestion into a specific proposal for the draft:

In section 9.4, add a note indicating that hash algorithm 1 is MD5,
but MD5 is deprecated, and SHOULD NOT be used.

In section 13, rephrase the current mild note about MD5 to be stronger
and cite the paper giving the MD5 collisions.

David

---

From: Lutz Donnerhacke <[email-masked]>
Date: Sat, 21 Aug 2004 22:13:33 +0000 (UTC)

* David Shaw wrote:
> True, but would you recommend using MD5 these days?

No. I won't recommend any hash soley based on bit-logic and modular
arithmentic these days.

> The time to deprecate it is before it is completely broken, and the
> attacks do pose a direct risk.

OpenPGP recommends SHA1. I'm feeling bad with this, but this is not the
subject of discussion.

> relatively easy to do so.

MD5 shares some weeknesses with other hash algoithms. Don't blame MD5 alone.

> but MD5 is deprecated, and SHOULD NOT be used.

So please add "SHA1 MAY NOT be used."

---

From: "Carl Ellison" <[email-masked]>
Date: Sat, 21 Aug 2004 22:33:39 -0700

Rumors aside, there is no published break of SHA-1.  Even SHA-0 isn't fully
broken.  People will continue to work on SHA-1 so it might break one of
these years, but I will still recommend using it.

 - Carl 

> -----Original Message-----
> From: [email-masked] 
> [mailto:[email-masked]] On Behalf Of Lutz Donnerhacke
> Sent: Saturday, August 21, 2004 3:14 PM
> To: [email-masked]
> Subject: Re: MD5 warning
> 
> 
> * David Shaw wrote:
> No. I won't recommend any hash solely based on bit-logic and modular
> arithmetic these days.
> 
> MD5 shares some weaknesses with other hash algorithms. Don't 
> blame MD5 alone.
>