Subject: RE: DIGEST-MD5: Family of mechanisms?

From: "Paul Leach" <[email-masked]>
Date: Tue, 3 Apr 2001 17:45:44 -0700

I'll give one good reason to eventually support a different hash
function: MD5 is not FIPS certified. And that by itself means that US
Gov't will be very against it, or at least won't want to use it, and
will likely cause some other password based protocol to come into
existence which _isn't_ Digest. Thus frustrating the very thing Chris is
trying to create: a uniform standard.

Whereas if we add SHA-1 as an optional hash function in V2, there will
be no such pressure. We might even be able to minimize changes to the
spec by only using the low 128 bits of all hash results. But I'd have to
pass that by a crypto expert.

As for AES, recall that it needs more than 128 bits of key, so we'd need
to define some way of creating a bigger one.

Paul

---

From: John Gardiner Myers <[email-masked]>
Date: Tue, 03 Apr 2001 18:32:22 -0700

Paul Leach wrote:
> be no such pressure.

This would be the tail wagging the dog.  We should not be causing
interoperability problems by introducing gratuitous features to please
irrational presumed cravings of an entity that hasn't even bothered to
participate in the IETF standardization process.

---

From: Ken Hornstein <[email-masked]>
Date: Tue, 03 Apr 2001 22:21:43 -0400

>trying to create: a uniform standard.

Just like to chime in here with my $0.02 about FIPS certification and
my experiences with it:

In general, those FIPS standards apply only to particular
_implementations_ that have gone through the certification process
(which is really lengthy and expensive).  I've only ever seen FIPS used
as a weak justification for not buying a particular product (and
FIPS-certified software crypto implementations are fairly rare).  I
know that occasionally it's applied to really big contract purchases,
but somehow people still manage to buy/use crypto products in the
Government that don't have a FIPS certification (and I really can't
imagine some new protocol coming into place just because MD5 doesn't
have a FIPS certification).  Mostly it's one of the billions of
government regulations that get ignored on a daily basis.

For example: No implementation of That Protocol That Might be Called
SSH is, AFAIK, FIPS-compliant, yet it's used in plenty of places in the
Government.  Same goes for OpenSSL.  I don't think that FIPS
certification or lack thereof should be used as a justification for
changing a protocol, and I agree with Chris that we shouldn't change
the protocol at this stage.

Note that despite my email address, I'm not a government employee, and
I'm not speaking for the government.

--Ken

---

From: John Gardiner Myers <[email-masked]>
Date: Tue, 03 Apr 2001 18:32:22 -0700

---

From: Ken Hornstein <[email-masked]>
Date: Tue, 03 Apr 2001 22:21:43 -0400

--Ken