Subject: Re: NIST publishes new DSA draft

From: [email-masked] ("Hal Finney")
Date: Tue, 14 Mar 2006 15:31:08 -0800 (PST)

James Couzens writes:
> I had thought it a bit strange that someone writing so comprehensively
> about something related to digital signatures and to then make the
> statement as you did at the end of the paragraph I quoted.  Did you have
> some other intended meaning, such as broken by draft explicit
> prohibition or otherwise declared deprecated in a future draft?

Yes, sorry, my language was not as precise as it might have been.
I said we should be ready in case SHA-1 were broken, but as you note
it has been officially "broken" for over a year.  However that is just
a theoretical break and no actual examples of SHA-1 message collisions
have yet been published.  So at this point SHA-1 is in a bit of a limbo
state, theoretically broken but still in widespread use.

If the attack should get worse so that SHA-1 collisions could be found
in a practical amount of time, then we would have a much more urgent
need to switch to another hash.  That is what I really meant when I
said we should be ready if SHA-1 should be broken.

Hal Finney

---

From: "Ian Grigg" <[email-masked]>
Date: Wed, 15 Mar 2006 04:29:10 -0500 (EST)

> state, theoretically broken but still in widespread use.

The problem lies in the use of the term "broken"
which sounds great in the popular press, but is
insufficiently precise for serious forums and
serious protocol work.  A more appropriate term is
that SHA1 is weakened - from 80 bits to 69 bits -
for some uses.

Analysis in this forum in the past has indicated
that - approximately - SHA1 is still good, but we
should move over as and when we can select good
alternatives.  NIST's new DSA announcement I think
makes the case that SHA256 is going to be around a
lot longer than some of us earlier speculated, so
that looks like the target for now.

> said we should be ready if SHA-1 should be broken.

Yes, it's a concern.  FTR, I agree with Hal that
we should seriously consider taking the draft out
of last call (dammit!) ... hopefully it won't take
too long to get enough consensus and some rough
working code?

iang

---

From: Werner Koch <[email-masked]>
Date: Wed, 15 Mar 2006 12:29:21 +0100

> of last call (dammit!) ... hopefully it won't take

I agree. 

However, SHA-256 should not be a MUST but a SHOULD.  Otherwise many
OpenPGP applications won't be compliant anymore.  In particular
applications on small devices may only support the MUST algorithms.

A remark that this SHOULD will be changed to a MUST algorithm in the
future will help to explain that we really want SHA-256.

Salam-Shalom,

   Werner

---

From: Ben Laurie <[email-masked]>
Date: Wed, 15 Mar 2006 11:57:15 +0000

> state, theoretically broken but still in widespread use.

Its also worth noting that reducing the collision resistance to 2^69
still leaves it stronger than unbroken MD5 and is still well within the
realms of hardness we require.

Cheers,

Ben.

-- 
http://www.apache-ssl.org/ben.html           http://www.links.org/

"There is no limit to what a man can do or how far he can go if he
doesn't mind who gets the credit." - Robert Woodruff