Subject: Re: DIGEST-MD5: Family of mechanisms?

From: Chris Newman <[email-masked]>
Date: Tue, 03 Apr 2001 16:44:07 -0700

I am strongly opposed to any change in the hash algorithm for DIGEST-MD5. 
The last chance to change the hash function passed when RFC 2069 was 
approved by the IESG.  If you didn't speak up during that last call, too 
bad.

Further, I strongly discourage further creation of equivalent hash-based 
algorithms unless DIGEST-MD5 authentication is found to be fundamentally 
broken due to MD5.  We need _one_ interoperable hash-based mechanism to 
deploy widely.  We've already jerked implementors around with the CRAM-MD5 
-> DIGEST-MD5 shift to the detriment of deployment, so I'd want to see a 
_very_ good reason before doing it at this late stage.

It's very important that H(A1) be kept constant, which means "H" can't 
change from MD5.  People dislike deploying software where user passwords 
are stored in the clear in a database on the server.  People dislike 
shipping software which does so by default.  So the only way I see to 
overcome that deployment barrier is to make H(A1) ubiquitous (yes, H(A1) is 
plaintext equivalent, but only for the user/realm combination, so it's an 
improvement over password in the clear).

I have no objections to adding AES as an optional crypto mechanism.  Since 
the security layer is already an optional feature of DIGEST-MD5, it's much 
safer to tweak.  Given that AES is significantly faster than 3DES and has 
significantly more solid cryptanalysis than RC4, I'd prefer to deprecate 
3DES and RC4 in favor of AES, but to prevent a recycle at proposed we'll 
have to leave 3DES as the MTIM.  The drawback to adding AES, is that we 
have to demo two interoperable implementations prior to moving the 
resulting spec to draft.

		- Chris

---

From: Alexey Melnikov <[email-masked]>
Date: Tue, 03 Apr 2001 18:08:09 -0600

> change from MD5.

Ok Chris, I am convinced. The next step, IMHO, is to remove *every reference*
to "H" because it doesn't add any value to the spec and even worse, it makes a
reader believe that there might be several different H functions.

Alexey

---

From: Chris Newman <[email-masked]>
Date: Tue, 03 Apr 2001 16:44:07 -0700

- Chris

---

From: Alexey Melnikov <[email-masked]>
Date: Tue, 03 Apr 2001 18:08:09 -0600

Alexey