Subject: MD5, SHA-0

From: Larry Masinter <[email-masked]>
Date: Tue, 17 Aug 2004 23:25:55 -0700

It's sometimes hard to discern technical details in news
articles. Anyone have a more reliable source on what
happened at Crypto 2004?

http://news.com.com/Crypto+researchers+abuzz+over+flaws/2100-1002_3-5313655.
html

I still haven't understood, for notary services, if
the notary service doesn't have the original document
but just the hash, what happens when the hash algorithm
is compromised?

Larry
-- 
http://larry.masinter.net

---

From: "Santosh Chokhani" <[email-masked]>
Date: Mon, 23 Aug 2004 16:26:24 -0400

Larry:

The initial reading is that SHA-1 is relatively safe, but people should move
to SHA 256 within next 5 years.

That said, LTANS does need to worry about what happens if the notary has the
hash of the document.  If the hash gets broken, it dilutes the document
existence claim.

I think one alternative is to use the encrypt scheme as ERS folks have
proposed for trusted archive.  Of course, the caveats in the ERS encryption
paper will apply.

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]
On Behalf Of Larry Masinter
Sent: Wednesday, August 18, 2004 2:26 AM
To: 'IETF LTANS'
Subject: MD5, SHA-0

It's sometimes hard to discern technical details in news articles. Anyone
have a more reliable source on what happened at Crypto 2004?

Larry

---

From: Denis Pinkas <[email-masked]>
Date: Wed, 25 Aug 2004 10:12:57 +0200

Santosh,

> hash of the document.  If the hash gets broken, it dilutes the document

No. Apply a new time-stamp token with a new hash function.

> proposed for trusted archive.  Of course, the caveats in the ERS encryption

Avoid any kind of encryption for that purpose.

Denis

---

From: "Carl Wallace" <[email-masked]>
Date: Wed, 25 Aug 2004 06:42:17 -0400

> > That said, LTANS does need to worry about what happens if 
> the notary 
> > has the hash of the document.  If the hash gets broken, it 
> dilutes the 
> > document existence claim.
> 

For what data should a new time-stamp token based on a new hash function be
obtained?  In this thread, the question related to the case where the notary
has only a hash of the original document.

---

From: "Santosh Chokhani" <[email-masked]>
Date: Wed, 25 Aug 2004 07:20:15 -0400

Carl, Denis:

My response was terse.  I assumed that the question was prompted with when
the Notary is given only the hash in the first place for the reasons of
confidentiality.

Thus, I was proposing that to preserve the confidentiality desired b the
submitter, we look into ERS encryption approach.

-----Original Message-----
From: Denis Pinkas [mailto:[email-masked]] 
Sent: Wednesday, August 25, 2004 4:13 AM
To: Santosh Chokhani
Cc: 'IETF LTANS'
Subject: Re: MD5, SHA-0

Santosh,

> Larry:
> 
> The initial reading is that SHA-1 is relatively safe, but people 
> should move to SHA 256 within next 5 years.
> 
> That said, LTANS does need to worry about what happens if the notary 
> has the hash of the document.  If the hash gets broken, it dilutes the 

> proposed for trusted archive.  Of course, the caveats in the ERS 
> encryption paper will apply.

Denis

> It's sometimes hard to discern technical details in news articles. 
> Anyone have a more reliable source on what happened at Crypto 2004?
>

---

From: Denis Pinkas <[email-masked]>
Date: Wed, 25 Aug 2004 13:35:24 +0200

Santosh,

> the Notary is given only the hash in the first place for the reasons of

Hum, hum !!!

My undersnding of the primary role of a notary (at least under the French 
legislation) is to look at the content of the document (already signed) 
before applying his own signature. Therefor I have some difficulties with 
schemes where the Notary would not have access to the semantics of the 
document. Otherwise the word "Notary" should not be used for that case.

Denis

---

From: "Santosh Chokhani" <[email-masked]>
Date: Wed, 25 Aug 2004 07:50:07 -0400

Denis:

If we assume that notary notarizes the original document, we do not have a
problem.

Larry:

Should the notary requirement make this clear? 

-----Original Message-----
From: Denis Pinkas [mailto:[email-masked]] 
Sent: Wednesday, August 25, 2004 7:35 AM
To: Santosh Chokhani
Cc: 'IETF LTANS'
Subject: Re: MD5, SHA-0

Santosh,

> Carl, Denis:
> 
> My response was terse.  I assumed that the question was prompted with 
> when the Notary is given only the hash in the first place for the 
> reasons of confidentiality.

Hum, hum !!!

Denis

> Thus, I was proposing that to preserve the confidentiality desired b 
> the submitter, we look into ERS encryption approach.
>

---

From: Ernst G Giessmann <[email-masked]>
Date: Thu, 26 Aug 2004 09:18:29 +0200

>> has the

It dilutes the proof of the document existence claim via *that* hash. If
the document existence claim proof can be thickened by other means, you
are safe.

> No. Apply a new time-stamp token with a new hash function.

Denis is right, this is a well known way of thickening.

> Avoid any kind of encryption for that purpose.

Denis is right again: Encryption is the way to protect a document from
disclosure but *not* from a wrong existence claim.

Ernst.