Subject: [rohc] SigComp possibly affected by rumored SHA-1 weakness

From: Carsten Bormann <[email-masked]>
Date: Wed, 16 Feb 2005 22:27:00 +0100

ROHCers,

we might find a nice round bullet-hole in SigComp's security (which is 
based on the collision resistance of SHA-1) within the next few days.

http://www.schneier.com/blog/archives/2005/02/sha1_broken.html

Stay tuned.

Gruesse, Carsten

_______________________________________________
Rohc mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/rohc

---

From: "West, Mark" <[email-masked]>
Date: Thu, 17 Feb 2005 00:02:32 +0000 (GMT)

> based on the collision resistance of SHA-1) within the next few days.

It will be interesting to see what the result actually is... my favourite
attacks on SigComp are based on achieving a partial hash collision, rather
than on a 'complete' collision.  It's not clear what effect this attack
has on partial hashes (compared with the full hash)

And if people think that a 6-byte partial hash is 'good enough', then the
2^48 hash size yields a collision probability way less than the 2^69
claimed for the 'break'...

I think that it is also worth taking into account the difference between
an 'offline' attack and a 'realtime' injection of colliding data.  To make
the latter a reality would need (I suspect) a more complete break than is
currently suspected.  But, then again, I may be wrong about that!

It's certainly a thought-provoking result...

Mark.

---

From: Carsten Bormann <[email-masked]>
Date: Thu, 17 Feb 2005 11:50:55 +0100

> claimed for the 'break'...

I agree that the 2^69 order of effort attack is not directly useful 
against SigComp, and there does not seem any published approach to 
obtain pre-image attacks anyway.
My concern is just that, after MD5 has been crumbling for a while, 
SHA-1 now took a major direct hit, and the history of crypto is that 
we'll see further results following from that.

It may be prudent to have an alternative to SigComp's use of SHA-1 
ready (and deployed?) at the time SHA-1 is finally sunk for real.  Thus 
my heads-up.
Of course, a large number of IETF security types are now having a large 
number of hallway conversations, so that standardization work may be 
done for us elsewhere.

Gruesse, Carsten