Subject: RE: DS design questions

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Thu, 3 Jan 2002 07:57:36 -0800

Support for multiple algorithms is somewhat tricky. In particular 
it is important to avoid a downgrade attack. There is no value in
supporting the use of a strong cipher and a weak one if the attacker
can convince the relying party that the weaker one was selected.

I would need to see a fuller description to be able to fully asses
the merits of the proposed mod.

	Phill

Phillip Hallam-Baker FBCS C.Eng.
Principal Scientist
VeriSign Inc.
[email-masked]
781 245 6996 x227

> -----Original Message-----
> From: Randy Bush [mailto:[email-masked]]
> Sent: Thursday, January 03, 2002 8:59 AM
> To: Paul Vixie
> Cc: [email-masked]
> Subject: Re: DS design questions 
> 
> 
> >> 1. Should the DS record have a digest identifier ?
> >> Right now SHA-1 is the only one specified, x years down the road
> >> we may need a stronger one. There are two ways to handle this,
> >> 	use digest identifier byte in the record
> >> 	Use the size of the DS record to signal the algorithm used.
> >> The second one is compatible with the current specified 
> format of the
> >> record, the first one is more explicit.
> > the second one opens the possibility that we will someday 
> add a pad byte
> > somewhere just to have a distinguishing length.  that way 
> lies madness.
> > i strongly recommend the use of an alg-id.
> 
> what paul said
> 
> randy
> 
> 
> to unsubscribe send a message to 
> [email-masked] with
> the word 'unsubscribe' in a single line as the message text body.
>

---

From: "Steven M. Bellovin" <[email-masked]>
Date: Thu, 03 Jan 2002 22:57:13 -0500

In message <5.1.0.14.2.20020102224702.024262b0@localhost>, =?iso-8859-1?Q?=D3la
fur?==?iso-8859-1?Q?_Gu=F0mundsson?= writes:
>I'm trying to get a new version of the draft out the door. The changes
>agreed to so far bring up few questions that I would like some input
>on before selecting one the possible.
>
>The second one is compatible with the current specified format of the

Definitely have an explicit identifier.  As Phillip said, the details 
of how it's done are important, but the risks of a downgrade attack are 
greater if there's ever any ambiguity about which algorithm is in use.

		--Steve Bellovin, http://www.research.att.com/~smb
		Full text of "Firewalls" book now at http://www.wilyhacker.com

to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.

---

From: "Steven M. Bellovin" <[email-masked]>
Date: Sat, 05 Jan 2002 02:11:10 -0500

In message <[email-masked]>, Olafur Gudmundsson 
writes:
>On Wed, 2 Jan 2002, Olafur Gudmundsson wrote:
>
>Thanks to everyone that has responded to these question either on the
>list or in private.
>
>Summary of results.
>>
>Yes, I will add a field to the DS record and require IETF standards
>action (the most difficult step) to create a new digest identifier,
>we do not what to many algorithms used.

A more important step than requiring a standards action is to define 
the precise semantics of the digest identifier, once more than one 
exists.  That has to be done now, regardless of the existence or 
non-existence of other choices, or today's code won't do the right
thing tomorrow when a new algorithm is added.