Subject: [OPSEC] Further MD5 breaks

From: "Vishwas Manral" <[email-masked]>
Date: Tue, 30 Dec 2008 17:32:50 -0800

Hi folks,

There is an interesting discussion on the saag list about "Further MD5
breaks: Creating a rogue CA certificate".

http://www.ietf.org/mail-archive/web/saag/current/msg02368.html .
There are some mails about the relative strengths of SHA related to
MD5 in that environment.

Thanks,
Vishwas
_______________________________________________
OPSEC mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/opsec

---

From: Joel Jaeggli <[email-masked]>
Date: Tue, 30 Dec 2008 21:45:57 -0800

Hehm I've been waiting for this message to arrive since early this
morning. I think the salient point, Which I made before is that if md5
is in the toolbox, someone, somewhere will use it for something
inappropriate.

Does that affect the problem at hand? Maybe, maybe not.

It is possible I believe to create a scenario where the potential for a
hash collision is either temporally or practically irrelevant.

As a community I think we've been less pro-active than we should have
been, but being deliberate is still the order of the day.

joel