Subject: [COSE] I-D Action: draft-ietf-cose-hash-algs-05.txt

From: [email-masked]
Date: Mon, 06 Jul 2020 12:18:03 -0700

A New Internet-Draft is available from the on-line Internet-Drafts directories.
This draft is a work item of the CBOR Object Signing and Encryption WG of the IETF.

        Title           : CBOR Object Signing and Encryption (COSE): Hash Algorithms
        Author          : Jim Schaad
	Filename        : draft-ietf-cose-hash-algs-05.txt
	Pages           : 12
	Date            : 2020-07-06

Abstract:
   The CBOR Object Signing and Encryption (COSE) syntax
   [I-D.ietf-cose-rfc8152bis-struct] does not define any direct methods
   for using hash algorithms.  There are, however, circumstances where
   hash algorithms are used, such as indirect signatures where the hash
   of one or more contents are signed, and X.509 certificate or other
   object identification by the use of a fingerprint.  This document
   defines a set of hash algorithms that are identified by COSE
   Algorithm Identifiers.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-cose-hash-algs/

There are also htmlized versions available at:
https://tools.ietf.org/html/draft-ietf-cose-hash-algs-05
https://datatracker.ietf.org/doc/html/draft-ietf-cose-hash-algs-05

A diff from the previous version is available at:
https://www.ietf.org/rfcdiff?url2=draft-ietf-cose-hash-algs-05

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

---

From: Ilari Liusvaara <[email-masked]>
Date: Mon, 6 Jul 2020 23:36:39 +0300

> "Unlike the SHA-2 hash functions, no algorithm identifier is created 
> for shorter lengths.  The length of the hash value stored is 128-bits
> for SHAKE-128 and 256-bits for SHAKE-256."

128-bits seems rather short, given that 128-bit collisions can be
generated with ~2^64 work using generic methods. And these are adverised
as cryptographic hashes, not just checksums/filters.

SHAKE-128 (SHAKE-256) itself maxes out at 128 (256) bit collision and
preimage resistance, so to get all out of it, one needs at least 256
(512) bit output.

-Ilari

---

From: Jim Schaad <[email-masked]>
Date: Mon, 6 Jul 2020 14:43:01 -0700

> -----Original Message-----
> From: COSE <[email-masked]> On Behalf Of Ilari Liusvaara
> Sent: Monday, July 6, 2020 1:37 PM
> To: [email-masked]
> Subject: Re: [COSE] I-D Action: draft-ietf-cose-hash-algs-05.txt
> 
> > This draft is a work item of the CBOR Object Signing and Encryption WG
of
> the IETF.
> >
> >         Title           : CBOR Object Signing and Encryption (COSE):
Hash
> Algorithms
generated with
> ~2^64 work using generic methods. And these are adverised as cryptographic
> hashes, not just checksums/filters.
> 
preimage
> resistance, so to get all out of it, one needs at least 256
> (512) bit output.

That makes sense.

Jim

> 
> 
> 
> -Ilari
> 
> _______________________________________________
> COSE mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/cose