Subject: RE: Update request for RFC3279 and 4055

From: "Santosh Chokhani" <[email-masked]>
Date: Wed, 28 Mar 2007 14:27:00 -0700

David,

I am concerned about the following statement: "As with the
fingerprint/thumbprint displayed by certificate viewers, the use of a
weak hash algorithm does not create any problems, security or
otherwise".

Some PKIs find it acceptable to obtain a trust anchor using unsecure
means and verify that the fingerprint of the trust anchor matches the
fingerprint obtained via secure means.  For these users, hashing
algorithm used for fingerprint does become security relevant.

(Granted that from what experts say, SHA-1 is not in an imminent danger
of pre-image attack.  Pre-image attack is required in order to exploit
the trust anchor substitution in the above scenario)

________________________________

From: [email-masked] [mailto:[email-masked]]
On Behalf Of David A. Cooper
Sent: Wednesday, March 28, 2007 12:39 PM
To: Scott Shorter
Cc: [email-masked]
Subject: Re: Update request for RFC3279 and 4055

Scott Shorter wrote:   

However, Subject Key Identifiers and Authority Key Identifiers are
defined in sections 4.2.1.2 and 4.2.1.1 of RFC3280 as using SHA-1 only.
A quick search of the forum archives reveals that this has been
discussed, but I must confess that I don't read the mailing list
religiously enough to know if there is a resolution and if so what it
is.

In RFC 3280 the two methods described for generating key identifiers
from keys both use SHA-1 and the text RECOMMENDS generating key
identifiers using one of the methods described in the document.  In
3280bis, the the two methods described for generating key identifiers
from keys are the same as in RFC 3280, but the recommendation has been
changed to read:

      Two common methods for generating key identifiers from
      the public key are described in section 4.2.1.2.  Where a
      key identifier has not been previously established, this
      specification RECOMMENDS use of one of these methods
      for generating keyIdentifiers or use of a similar method that
      uses a different hash algorithm.

So, 3280bis now specifically notes that hash algorithms other than SHA-1
may be used to generate key identifiers.

As with the fingerprint/thumbprint displayed by certificate viewers, the
use of a weak hash algorithm does not create any problems, security or
otherwise.  Furthermore, since the certificate does not specify the
method by which the key identifiers were generated, the use of SHA-1 is
unlikely to even lead to perception problems since very few relying
parties would be able to determine that SHA-1 was used to generate the
key identifiers, and those who did determine this would most likely be
knowledgeable enough to understand that it is OK to use SHA-1 to
generate key identifiers even if it is too weak to use in other places.

Dave

---

From: Paul Hoffman <[email-masked]>
Date: Wed, 28 Mar 2007 18:24:02 -0700

At 2:27 PM -0700 3/28/07, Santosh Chokhani wrote:
>fingerprint/thumbprint displayed by certificate viewers, the use of 
>a weak hash algorithm does not create any problems, security or 
>otherwise".
>
>means and verify that the fingerprint of the trust anchor matches 
>the fingerprint obtained via secure means.  For these users, hashing 
>(Granted that from what experts say, SHA-1 is not in an imminent 
>danger of pre-image attack.  Pre-image attack is required in order 
>to exploit the trust anchor substitution in the above scenario)

This is confusing. If a pre-image attack is required in order to 
exploit the trust anchor substitution, why are you concerned about 
the statement?

--Paul Hoffman, Director
--VPN Consortium

---

From: "Santosh Chokhani" <[email-masked]>
Date: Thu, 29 Mar 2007 03:43:12 -0700

Because of the blanket statement about the security of the hash
algorithm.  It does matter that it be something akin to SHA1

-----Original Message-----
From: Paul Hoffman [mailto:[email-masked]] 
Sent: Wednesday, March 28, 2007 9:24 PM
To: Santosh Chokhani; [email-masked]
Subject: RE: Update request for RFC3279 and 4055

--Paul Hoffman, Director
--VPN Consortium