Subject: Re: Instance Digests in HTTP (RFC3230)

From: Lisa Dusseault <[email-masked]>
Date: Thu, 1 Oct 2009 16:22:34 -0700

Isn't more digest values worse for interoperability?  Is there an overriding
security concern that would justify worse interoperability?

Lisa

On Mon, Sep 28, 2009 at 11:27 PM, Anthony Bryan <[email-masked]>wrote:

> I'd like to update the Hypertext Transfer Protocol (HTTP) Digest
> Algorithm Values registry [1] created by RFC3230.
>
> Current values are MD5, SHA, UNIXsum, UNIXcksum.
>
> I'd like to add SHA-224, SHA-256, SHA-384, and SHA-512.
> My metalinkhttp ID [2] lists these in the IANA considerations section.
>
> I'd also like to find out about current support of Instance Digests on
> the client & server side.
>
> Should I keep these registrations in the metalinkhttp ID, or separate
> them [attached]? They're not specifically tied to metalinkhttp.
>
> Other questions...
> Current registry: MD5 lists both RFC1521 and RFC20456 for base64
> encoding. Should this draft update it to refer to just one?
>
> Current registry: SHA link ( http://csrc.nist.gov/fips/fip180-1.txt )
> is no longer valid. Should this draft update it?
>
> If we update SHA in the registry, should this draft refer to SHS or
> RFC3174?
>
> --
> (( Anthony Bryan ... Metalink [ http://www.metalinker.org ]
>  )) Easier, More Reliable, Self Healing Downloads
>
> [1] http://www.iana.org/assignments/http-dig-alg/http-dig-alg.xhtml
> [2] http://tools.ietf.org/html/draft-bryan-metalinkhttp
>

---

From: Anthony Bryan <[email-masked]>
Date: Sun, 4 Oct 2009 02:21:48 -0400

Interoperability seems rather lax, especially because I haven't been
able to find if there is actually any server side support (in shipping
code) for anything to interoperate with. Does anyone know of any?
I know of a few clients with support.

>From RFC3230, 4.3.2 Digest

   A Digest header field MAY contain multiple instance-digest values.
   This could be useful for responses expected to reside in caches
   shared by users with different browsers, for example.

   A recipient MAY ignore any or all of the instance-digests in a Digest
   header field.

   A sender MAY send an instance-digest using a digest-algorithm without
   knowing whether the recipient supports the digest-algorithm, or even
   knowing that the recipient will ignore it.

Because there are no recent values in the registry, I see download
clients do this (3x variants of SHA1, 2x of other hashes):

Want-Digest: MD5;q=0.3, MD-5;q=0.3, SHA1;q=0.8, SHA;q=0.8,
SHA-1;q=0.8, SHA256;q=0.9, SHA-256;q=0.9, SHA384;q=0.9, SHA-384;q=0.9,
SHA512;q=1, SHA-512;q=1

(IANA registry Hash Function Textual Names
http://www.iana.org/assignments/hash-function-text-names/hash-function-text-names.xhtml
has updated values).

Various organizations warn...

http://www.kb.cert.org/vuls/id/836068

"Do not use the MD5 algorithm
Software developers, Certification Authorities, website owners, and
users should avoid using the MD5 algorithm in any capacity. As
previous research has demonstrated, it should be considered
cryptographically broken and unsuitable for further use."

http://csrc.nist.gov/groups/ST/hash/policy.html

"Federal agencies should stop using SHA-1 for digital signatures,
digital time stamping and other applications that require collision
resistance as soon as practical, and must use the SHA-2 family of hash
functions for these applications after 2010... Regardless of use, NIST
encourages application and protocol designers to use the SHA-2 family
of hash functions for all new applications and protocols."

And various organizations have put it into practice:

https://fedoraproject.org/wiki/Features/StrongerHashes
ftp://ftp.freebsd.org/pub/FreeBSD/releases/amd64/ISO-IMAGES/7.2/CHECKSUM.SHA256
ftp://iso5.us.netbsd.org/pub/NetBSD/iso/5.0.1/SHA512

---

From: Henrik Nordstrom <[email-masked]>
Date: Sun, 04 Oct 2009 15:14:23 +0200

tor 2009-10-01 klockan 16:22 -0700 skrev Lisa Dusseault:
> Isn't more digest values worse for interoperability?  Is there an
> overriding security concern that would justify worse interoperability?

Additional digest values do not make interop much worse than it already
is, but there should be a minimum required set on both clients and
servers.

Related to this the negotiation aspect of RFC3230 should generally not
be used on cachable responses as doing so would create yet another set
of instances varying on the set of client indicated supported hashes. On
such responses the server should just spew out the set of hashes it
prefers to support with both interop and security in mind (i.e. usually
one or two hashes today, maybe three).

Regards
Henrik

---

From: Nicolas Alvarez <[email-masked]>
Date: Tue, 06 Oct 2009 13:30:34 -0300

Anthony Bryan wrote:
> On Thu, Oct 1, 2009 at 7:22 PM, Lisa Dusseault wrote:

Clearly, if we don't add SHA-1 to the registry, people will use it anyway,
but won't decide on a single name for it. *That's* worse for
interoperability.

---

From: Lisa Dusseault <[email-masked]>
Date: Tue, 6 Oct 2009 12:09:01 -0700

These responses do convince me why we need to add at least a couple more
digest types to the registry.  Since changes to this registry require a
specification, I can offer to shepherd that specification (it can be an
individual submission to Informational status, I'm pretty sure).

Thanks,
Lisa

---

From: Anthony Bryan <[email-masked]>
Date: Tue, 6 Oct 2009 17:03:10 -0400

I take it you want these split out of metalinkhttp ID? They're not
specifically tied to metalinkhttp, so I've just submitted it
separately as an individual submission with Informational status.

Other questions:

If we update SHA in the registry, should this draft refer to SHS or RFC3174?

A new version of I-D,
draft-bryan-http-digest-algorithm-values-update-00.txt has been
successfuly submitted by Anthony Bryan and posted to the IETF
repository.

Filename:        draft-bryan-http-digest-algorithm-values-update
Revision:        00
Title:           Hypertext Transfer Protocol (HTTP) Digest Algorithm
Values Registry Update
Creation_date:   2009-10-06
WG ID:           Independent Submission
Number_of_pages: 5

Abstract:
[RFC3230] created the IANA registry named "Hypertext Transfer
Protocol (HTTP) Digest Algorithm Values" which defines values for
digest algorithms used in HTTP.  This draft adds new values to the
registry.

On Tue, Oct 6, 2009 at 3:09 PM, Lisa Dusseault <[email-masked]> wrote:
> On Tue, Oct 6, 2009 at 9:30 AM, Nicolas Alvarez <[email-masked]>
> wrote:
>>
>> Anthony Bryan wrote:

---

From: Anthony Bryan <[email-masked]>
Date: Thu, 15 Oct 2009 10:53:27 -0400

New version incorporates comments from Pasi Eronen.

-02 : October 15, 2009.
   o  New title.
   o  "Note: This is unrelated to HTTP Digest Authentication."
   o  Remove SHA-224 and SHA-384.
   o  "Changes compared to RFC3230" section added.

A new version of I-D,
draft-bryan-http-digest-algorithm-values-update-02.txt has been
successfuly submitted by Anthony Bryan and posted to the IETF
repository.

Filename:        draft-bryan-http-digest-algorithm-values-update
Revision:        02
Title:           Additional Hash Algorithms for HTTP Instance Digests
Creation_date:   2009-10-15
WG ID:           Independent Submission
Number_of_pages: 5

Abstract:
[RFC3230] created the IANA registry named "Hypertext Transfer
Protocol (HTTP) Digest Algorithm Values" which defines values for
digest algorithms used in HTTP.  This draft adds new values to the
registry and updates previous values.

---

From: Anthony Bryan <[email-masked]>
Date: Tue, 27 Oct 2009 19:08:32 -0400

Revision 03 has tiny changes (RFC3230 -> RFC 3230), and earlier
incorporated suggestions from secdir list.

---------- Forwarded message ----------
From: IETF I-D Submission Tool <[email-masked]>
Date: Wed, Oct 21, 2009 at 6:42 PM
Subject: New Version Notification for
draft-bryan-http-digest-algorithm-values-update-03
To: [email-masked]

A new version of I-D,
draft-bryan-http-digest-algorithm-values-update-03.txt has been
successfuly submitted by Anthony Bryan and posted to the IETF
repository.

Filename:        draft-bryan-http-digest-algorithm-values-update
Revision:        03
Title:           Additional Hash Algorithms for HTTP Instance Digests
Creation_date:   2009-10-21
WG ID:           Independent Submission
Number_of_pages: 5

Abstract:

The IETF Secretariat.