Subject: Re: ASN.1 OID for TIGER/192

From: David Hopwood <[email-masked]>
Date: Tue, 01 Oct 2002 21:20:24 +0000

-----BEGIN PGP SIGNED MESSAGE-----

David Shaw wrote:
> In 2440 and in all the 2440bis drafts, the TIGER/192 hash is not fully
> usable as it has no OID.  Werner Koch and I, with the cooperation of
> TIGER's authors, recently arranged an OID for it:
> 
>         1.3.6.1.4.1.11591.12.2

I hope that is only the OID for Tiger-192 with 3 passes (as used by OpenPGP),
not Tiger in general. SHA-256, SHA-384 and SHA-512, for example, have
separate OIDs.

> It would be good to put this in 2440bis so TIGER will be usable.

Note the potential problems with the Tiger specification and test vectors
described here:
<http://www.users.zetnet.co.uk/hopwood/crypto/scan/md.html#Tiger>

> I have a sneaking suspicion that this may raise the question whether
> TIGER should be in the standard at all, as so long as it did not have
> an OID, the question was moot.  I have no strong feelings on this
> point, but if we are not going to allow the use of TIGER, then perhaps
> we should remove it from the standard altogether or explicitly
> disallow its use as the current halfway state is confusing now that
> there is an OID available.

I agree, and the same applies to HAVAL. However, my vote is to remove both
Tiger and HAVAL; there's no reason to believe they have any security or
other advantages over the other supported hashes.

- -- 
David Hopwood <[email-masked]>

Home page & PGP public key: http://www.users.zetnet.co.uk/hopwood/
RSA 2048-bit; fingerprint 71 8E A6 23 0E D3 4C E5  0F 69 8C D4 FA 66 15 01
Nothing in this message is intended to be legally binding. If I revoke a
public key but refuse to specify why, it is because the private key has been
seized under the Regulation of Investigatory Powers Act; see www.fipr.org/rip

---

From: Jon Callas <[email-masked]>
Date: Sun, 06 Oct 2002 14:43:02 -0700

I confess I am wondering why this is needed. Five years ago, we flirted with
Tiger and Haval because you need wider hashes for better signatures. 192
bits is a bit dodgy because it only gets you an effective strength of 96
bits (over 80 bits for SHA-1). Today, we have all the wide SHAs in the
suite, which balance with symmetric ciphers up to 256 bits of key size.
Adding in TIGER/192 now seems like too little, too late. In 1998, this would
have been great. In 2002 (pushing 2003), it's at best a yawn.

In short, here's a pragmatic question I have: if I were making a signature
today, and I thought that SHA-1 weren't big enough, why would I want to use
TIGER/192 over SHA-{256|384|512}?

Without a good answer to that question, I don't see why it should be there.
I'm even slightly sympathetic to people who think it and HAVAL should be
removed. They've both been overtaken by events.

    Jon