Subject: how close is OpenPGP tied to SHA1

From: Peter Thomas <[email-masked]>
Date: Mon, 2 Feb 2009 02:24:59 +0100

Hi WG.

After reading the whole RFC I've found several places where SHA1 is
given as the only possible algorithm, e.g. the whole MDC stuff, or the
revocation key signature subpacket (it has these 20 octets of the
fingerprint).
In addition to that we depend very much on SHA1 as our fingerprints
uses it, and if I understand correct the whole web of trust uses them
at keysigning parties, etc.

Now how close are the two tied?

I mean the signatures are completely independent of SHA1 (one can use
a different hash algo for them), and the signatures are not calculated
over fingerprints but over data, right?
So in principle one could say, that it would be better not to use
fingerprints when two people sign their keys, but the should better
really exchange secured copies of their public keys, ok?

I still remember the first papers about possible attacks on SHA1
(though I don't know the current state on this),... and we've already
seen how fast MD5 was completely hacked.
So what would happen if the same happens to SHA1? Would the existing
web of trust (I mean the existing keys and their relationships) blow
up?

Bye,
Peter

btw: Is there a difference between OpenPGP's MDC and MAC's?

---

From: Daniel Kahn Gillmor <[email-masked]>
Date: Sun, 01 Feb 2009 20:59:56 -0500

On 02/01/2009 08:24 PM, Peter Thomas wrote:
> given as the only possible algorithm,

This was just discussed on the list last month in a thread titled "A
review of hash function brittleness in OpenPGP":

  http://www.imc.org/ietf-openpgp/mail-archive/msg30323.html

It would be worth reviewing that thread because it contains relevant
discussion.  In short: the fingerprints seem to be the most worrisome
part, and we probably need to think about how to move forward.

Proposals?

	--dkg

---

From: John Clizbe <[email-masked]>
Date: Sun, 01 Feb 2009 20:27:27 -0600

Daniel Kahn Gillmor wrote:
> discussion.  

http://www.imc.org/ietf-openpgp/ has links to the indexed archive as well as how
to obtain the entire archive in mbox format

- --
John P. Clizbe                      Inet:John (a) Mozilla-Enigmail.org
You can't spell fiasco without SCO. hkp://keyserver.gingerbear.net  or
     mailto:[email-masked]?subject=HELP

Q:"Just how do the residents of Haiku, Hawai'i hold conversations?"
A:"An odd melody / island voices on the winds / surplus of vowels"

---

From: Peter Thomas <[email-masked]>
Date: Mon, 2 Feb 2009 14:14:40 +0100

Hi Daniel.

> review of hash function brittleness in OpenPGP":
Thanks for that pointer.

> Proposals?
Well,.. not really ;-)
The first question would be: Are SHA2 algorithms really more secure
than SHA1? If so one could think to switch for example to SHA512.
Or even wait for SHA3.
Or are there any other promising hash functions? Whirlpool?

Greetings,
Peter

---

From: Daniel Kahn Gillmor <[email-masked]>
Date: Mon, 02 Feb 2009 10:58:04 -0500

> Or are there any other promising hash functions? Whirlpool?

I think the answer is not to pick a "new, better" hash function for a
revised spec, but to make the spec flexible enough to actually use
whatever "new, better" hash function comes along (and to be able to
deprecate the ones implementors/users feel are untrustworthy).

So for the RFC it's more a question of making sure that everything is
parameterized than it is to say specific things like "no more MD5",
which may rapidly become out-of-date.

	--dkg

---

From: Jon Callas <[email-masked]>
Date: Mon, 2 Feb 2009 11:04:00 -0800

On Feb 2, 2009, at 5:14 AM, Peter Thomas wrote:

> than SHA1?

Yes.

> If so one could think to switch for example to SHA512.

You could. This is what most people are doing.

> Or even wait for SHA3.

This is likely the best answer.

> Or are there any other promising hash functions? Whirlpool?

Whirlpool is in my opinion a 2005 answer, not a 2009 answer. The  
problem with Whirlpool is that it's slow, and still not as well  
examined as SHA2.

Nonetheless, I've heard tell that someone is working on a Whirlpool I- 
D, which isn't a bad thing, but is arguably unneeded presently.

	Jon

---

From: Peter Thomas <[email-masked]>
Date: Mon, 2 Feb 2009 22:43:42 +0100

> deprecate the ones implementors/users feel are untrustworthy).

Of course :-)

Peter

---

From: Daniel Kahn Gillmor <[email-masked]>
Date: Mon, 02 Feb 2009 17:03:20 -0500

On 02/02/2009 04:42 PM, Peter Thomas wrote:
> Does anyone know the state on SHA3?

http://csrc.nist.gov/groups/ST/hash/timeline.html

Note that agencies of the US federal gov't are required to have fully
phased out SHA-1 by the end of 2010:

http://csrc.nist.gov/groups/ST/hash/statement.html

	--dkg

---

From: Peter Thomas <[email-masked]>
Date: Mon, 2 Feb 2009 22:42:44 +0100

>> The first question would be: Are SHA2 algorithms really more secure

Does it protect against the attacks recently found in SHA1?
Or is it "just" better, because the larger hash size?

> You could. This is what most people are doing.

Ok,.. but you cannot fully leave SHA1,.. you can only switch you
signature hash algorithm, as far as I know.
Right?

Best wishes,
Peter

---

From: John Clizbe <[email-masked]>
Date: Mon, 02 Feb 2009 16:18:07 -0600

> Does anyone know the state on SHA3?

"Googleâ¢ Is Your FriendÂ®"

	http://www.google.com/search?q=nist+hash+competition

http://csrc.nist.gov/groups/ST/hash/sha-3/Round1/index.html

    "The selection process will take around four years. I've previously called
     this sort of thing a cryptographic demolition derby -- last one left
     standing wins -- but that's only half true. Certainly all the groups will
     spend the next couple of years trying to cryptanalyze each other, but in
     the end there will be a bunch of unbroken algorithms; NIST will select one
     based on performance and features." -Schneier
	http://www.schneier.com/blog/archives/2008/10/the_skein_hash.html

- --

---

From: Ian G <[email-masked]>
Date: Mon, 02 Feb 2009 23:23:20 +0100

> This is likely the best answer.

For this group, it is, I agree.

iang

---

From: Ian G <[email-masked]>
Date: Mon, 02 Feb 2009 23:38:00 +0100

>> deprecate the ones implementors/users feel are untrustworthy).

<cough -:>

There are two poles of thought.

Pole One is "agility" which involves being able to switch between 
different algorithms within packets and protocols.  So if an algorithm 
goes belly up, the market migrates by switching over that algorithm.

Pole Two is "the one true cipher suite."  PGP 2 and so forth.  The 
notion here is that you design it well, you design it balanced, and you 
plan on it lasting at least 10 years.  If not 20 or 30.  Then, you throw 
the whole lot out in 10 years.

Whether you gravitate around Pole One or Pole Two depends on a whole 
host of factors:  economics, business, distributions, compatibility, 
structure of players, law & barriers, engineers & polemicists, 
cryptoreligion, etc.

For my money, Pole Two delivers much more bang for buck.  There has 
never been in modern history a complete collapse of a well-designed 
suite.  But there have been huge, monstrous, embarrassing efforts spent 
and lost in maintaining "agile" suites;  if the OSS's sabotage manual 
were updated today, it would almost certainly include a section 
suggesting much attention paid to perfect agility.

</ahem>

iang

---

From: David Crick <[email-masked]>
Date: Mon, 2 Feb 2009 22:55:25 +0000

On Mon, Feb 2, 2009 at 10:38 PM, Ian G <[email-masked]> wrote:
> Pole One is "agility" which involves being able to switch between different
> algorithms within packets and protocols.  So if an algorithm goes belly up,
> the market migrates by switching over that algorithm.
>
> Pole Two is "the one true cipher suite."  PGP 2 and so forth.  The notion
> here is that you design it well, you design it balanced, and you plan on it
> lasting at least 10 years.  If not 20 or 30.  Then, you throw the whole lot
> out in 10 years.
>
> Whether you gravitate around Pole One or Pole Two depends on a whole host of
> factors:  economics, business, distributions, compatibility, structure of
> players, law & barriers, engineers & polemicists, cryptoreligion, etc.
>
> For my money, Pole Two delivers much more bang for buck.  There has never
> been in modern history a complete collapse of a well-designed suite.  But
> there have been huge, monstrous, embarrassing efforts spent and lost in
> maintaining "agile" suites;  if the OSS's sabotage manual were updated
> today, it would almost certainly include a section suggesting much attention
> paid to perfect agility.
>
> </ahem>
>
> iang

or we do a compromise of both approaches:

agility but with a few MUSTs

(of course, this leads to a few backwards-compatibility
overheads / undesirables, such as 3DES ending up as
a MUST with ECC)

---

From: Peter Thomas <[email-masked]>
Date: Tue, 3 Feb 2009 00:50:49 +0100

If this WG finds a solution to this issue, e.g. by switching
everything to SHA3. What will happen to already existing keys?
I mean would it become necessary to create new keys in order to fully
benefit from the swtich?

Could there be problems with the already existing signatures using
(probably) SHA1 and downgrade attacks or similar things?

Greetings,
Peter