Subject: SHA1 weaknesses...

From: Joseph Galbraith <[email-masked]>
Date: Wed, 30 Mar 2005 12:49:52 -0700

I kind of hate to do this, but...

In light of recent SHA1 weaknesses, which, if I understand
correctly, may not really effect SSH, but are still worrisome,
should we be looking at introducing a document for using
SHA256?

Or are the vulnerabilities too remote, and so much
not an issue for our SSH usage, that we don't need
to do anything in response?

Thanks,

Joseph, the non-cryptographer

---

From: Jeffrey Hutzelman <[email-masked]>
Date: Wed, 30 Mar 2005 15:02:28 -0500

> to do anything in response?

I would encourage anyone pondering this question to read

- The saag proceedings from IETF62, particularly Eric Rescorla's talk.
- draft-hoffman-hash-attacks-00.txt
- The current discussion on this topic on the saag mailing list.

-- Jeffrey T. Hutzelman (N3NHS) <[email-masked]>
   Sr. Research Systems Programmer
   School of Computer Science - Research Computing Facility
   Carnegie Mellon University - Pittsburgh, PA

---

From: [email-masked] (Peter Gutmann)
Date: Thu, 31 Mar 2005 15:09:18 +1200

Joseph Galbraith <[email-masked]> writes:

>In light of recent SHA1 weaknesses, which, if I understand correctly, 
>may not really effect SSH, but are still worrisome, should we be 
>looking at introducing a document for using SHA256?
>
>Or are the vulnerabilities too remote, and so much not an issue for 
>our SSH usage, that we don't need to do anything in response?

It doesn't affect its use in either PRFs or HMAC, so SSH is unaffected
(I've been working on an article for IEEE S&P for this, but it'll 
probably be awhile before it appears).  There's no need to rush out and 
change anything because of this, better to wait until we know whether 
SHA-2 or Whirlpool is the way to go.

Peter.

---

From: Matt Johnston <[email-masked]>
Date: Thu, 31 Mar 2005 14:18:43 +0800

> SHA-2 or Whirlpool is the way to go.

Wouldn't lack of collision resistance in SHA1 leave a
vulnerability with using fingerprints of host public keys
for verification?  (mentioned in the -architecture draft).

Of course this isn't a mandatory part of the spec, though
it's common in various implementations.

Matt

---

From: Ben Harris <[email-masked]>
Date: Thu, 31 Mar 2005 12:29:36 +0100

>for verification?  (mentioned in the -architecture draft).

No.  A collision attack might allow an attacker to make two different keys
that have the same fingerprint, but it wouldn't allow them to make a single
key that has the same fingerprint as some other existing key.

-- 
Ben Harris

---

From: Bill Sommerfeld <[email-masked]>
Date: Thu, 31 Mar 2005 15:26:31 -0500

On Wed, 2005-03-30 at 22:09, Peter Gutmann wrote:
> There's no need to rush out and 

strongly agreed.   And I may be mistaken but my understanding is that
we're still waiting for the researchers to show all their work; a better
understanding of their attack should influence whether to go with SHA-2,
whirlpool, or some yet-to-be-designed hash algorithm.

						- Bill