Subject: Re: New results against SHA-1

From: [email-masked]
Date: Mon, 04 May 2009 14:39:48 -0400

On Mon, 04 May 2009 11:32:04 -0400 Daniel Kahn Gillmor 
<[email-masked]> wrote:
>On 04/30/2009 06:39 PM, David Shaw wrote:
>> 
>> 
>http://eurocrypt2009rump.cr.yp.to/837a0a8086fa6ca714249409ddfae43d.

>pdf
>> 
>> There is not much hard information yet, but the two big quotes 
>are
>> "SHA-1 collisions now 2^52" and "Practical collisions are within
>> resources of a well funded organisation."

>What else should be addressed?  

MDC's ?

currently SHA-1
rfc-4880 p. 49 ff

vedaal

any ads or links below this message are added by hushmail without 
my endorsement or awareness of the nature of the link

--
Click to learn about options trading and get the latest information.
 http://tagline.hushmail.com/fc/BLSrjkqecvgn6JU6GKTTYn4JLCimaHzrO00szZPMXyt3Ax5yZ2fL1OvWzD6/

---

From: Daniel Kahn Gillmor <[email-masked]>
Date: Mon, 04 May 2009 15:15:14 -0400

> rfc-4880 p. 49 ff

Ah, right.  Jon Callas' remarks about the MDC from back in January might
be relevant:

  http://lists.gnupg.org/pipermail/gnupg-devel/2009-May/024967.html

I think his point stands that the MDC only cares about the one-wayness
of the digest used in MDC -- there is no reliance on a
collision-resistance property.  So i'm not sure that this needs to
change in a new draft, particularly if it could make the discussion more
contentious.

What do other folks think?

	--dkg

---

From: David Crick <[email-masked]>
Date: Mon, 4 May 2009 20:25:26 +0100

> What do other folks think?

I think we need to address it; we may as well, plus also
during the IETF review of the draft of what would become
4880, we have to CONVINCE IETF that it was "OK" to use
SHA-1 here (when there were already concerns about it).

"SHA-1 baad, mm'ok?" :)

---

From: Peter Gutmann <[email-masked]>
Date: Tue, 05 May 2009 14:46:29 +1200

>What do other folks think?

Given that the MDC is a hash of plaintext that's then encrypted, and the hash 
value is itself encrypted, I'm not losing any sleep over it.  The hash attacks 
so far have required bit-for-bit carefully-chosen plaintext with known hash 
values, not unknown (or even partially-known) plaintext with an unknown hash 
value.

Peter.

---

From: Jon Callas <[email-masked]>
Date: Tue, 5 May 2009 10:43:57 -0700

> values, not unknown (or even partially-known) plaintext with an  

I'm not losing a lot of sleep over it, either.

The point of the MDC is to provide a low-level integrity check.  
There's an easy high-level integrity check, a digital signature. The  
MDC exists for people who don't want to sign, but do want more  
protection than naked CFB mode, which is completely vulnerable to  
truncation.

The construction we use is not "secure". I put scare quotes around it  
for a reason. In particular, it's vulnerable to existential forgeries.  
However, every spam in the world is an existential forgery, and if you  
wanted to send an MDC forgery to someone, it's much easier to just  
write the message and encrypt it to them than modifying an existing  
message. What that means is that while there are some protocols that  
really have to worry about existential forgeries (like IPsec), we're  
really not one of them, especially since there's always signing for us.

In 4880, we described how one might upgrade the MDC. If someone  
believes it's important, I would support anyone writing a draft for an  
upgraded MDC. (But as an implementer, I can't make a statement as to  
when or if PGP would implement it.)

	Jon