Subject: RE: DIGEST-MD5: Family of mechanisms?

From: "Kurt D. Zeilenga" <[email-masked]>
Date: Tue, 03 Apr 2001 18:34:51 -0700

At 05:45 PM 4/3/01 -0700, Paul Leach wrote:
>I'll give one good reason to eventually support a different hash
>function: MD5 is not FIPS certified. And that by itself means that US
>Gov't will be very against it, or at least won't want to use it, and
>will likely cause some other password based protocol to come into
>existence which _isn't_ Digest. Thus frustrating the very thing Chris is
>trying to create: a uniform standard.

Well, using that argument, you'd also need to replace HMAC-MD5
as well....

I don't view the US Gov't as being very against MD5 (though
I agree that they might prefer SHA1).  I think one of the
biggest concerns of the gov'ts and other large organizations
with SASL and DIGEST-MD5 is that it hasn't yet reached
Draft Standard status.  I think getting what have to Draft
Standard in a timely fashion will remove a significant
hurdle in making these technologies becoming ubiquitous.

Kurt

---

From: "Paul Leach" <[email-masked]>
Date: Tue, 3 Apr 2001 19:41:51 -0700

Yes, the US Gov't often doesn't directly participate in IETF, but there
are some of us who do participate who listen to our customers.

BTW: it is many more customers that just the US Gov't. Those other
customers often believe that the reason MD5 isn't FIPS certified is that
there is something wrong with it.

Paul

---

From: "Paul Leach" <[email-masked]>
Date: Tue, 3 Apr 2001 19:51:29 -0700

Remember, even though I thought it was a good idea, I still said it
should be in _V2_. I'm not in favor of slowing down getting to Draft
Standard.

All I was doing was responding to a comment that (as I read it) said
there was _no_ good reason to use a different hash function. I gave _a_
reason that I thought was consistent with the objective of not having
many options -- that if we didn't do something, a worse option would
come into being. I'm happy to let everyone decide for themselves how
_good_ a reason it is.

But I am going to look into why there are SHA1 options for the hash in
SSL...

Paul

---

From: "Paul Leach" <[email-masked]>
Date: Tue, 3 Apr 2001 17:45:44 -0700

Whereas if we add SHA-1 as an optional hash function in V2, there will
be no such pressure. We might even be able to minimize changes to the
spec by only using the low 128 bits of all hash results. But I'd have to
pass that by a crypto expert.

As for AES, recall that it needs more than 128 bits of key, so we'd need
to define some way of creating a bigger one.

Paul

---

From: "Kurt D. Zeilenga" <[email-masked]>
Date: Tue, 03 Apr 2001 18:34:51 -0700

Kurt

---

From: "Paul Leach" <[email-masked]>
Date: Tue, 3 Apr 2001 19:41:51 -0700

Paul

---

From: "Paul Leach" <[email-masked]>
Date: Tue, 3 Apr 2001 19:51:29 -0700

Paul