Subject: [ietf-tls] Different message digest schemes for SRP?

From: "David Taylor" <[email-masked]>
Date: Thu, 14 Jun 2001 18:44:18 +1000

Hi,

A GNU TLS project has been started, and while they were waiting for ASN.1
software they decided to implement the SRP cipher suite.

In doing this, they've added a feature whereby the message digest used with
SRP can be selected.

My implementation just used SHA-1 as per the RFC. The GNU guys have added a
blowfish based option too.

Is this useful enough to put in the draft? Or is leaving it with SHA-1 good
enough?

I imagine the client will have to present a list of SRP message digests it
knows, along with the user name. Then the server will have to respond with
the one it selected, along with the n, g, s parameters.

I feel SRP with SHA-1 is good enough, although if there is already a spot
for a replacement if SHA-1 is found to be defective we'll have saved some
time.

Regards,
David Taylor.

---
You are currently subscribed to ietf-tls as: [email-masked]
To unsubscribe send a blank email to [email-masked]

---

From: Tom Wu <[email-masked]>
Date: Thu, 14 Jun 2001 13:57:29 -0700

> In doing this, they've added a feature whereby the message digest used with

Are you referring to the digest used to convert the password into a
private key, or the digest used for computing the "proof" hashes in the
Finished messages?  If it's the former, I would hold off on trying to
extend the standard to accommodate alternate hashes until the
interoperability issues are worked out.

> the one it selected, along with the n, g, s parameters.

Assuming that we're talking about the password hash being selectable,
you'd have to have the client send the user name to the server, and then
have the server respond with the message digest used, along with n, g,
and s.  But this leads to interoperability problems because a SHA-only
client could not talk to a server that allowed both SHA and blowfish.

> for a replacement if SHA-1 is found to be defective we'll have saved some

I agree.  Stick to SHA-1.

-- 
Tom Wu
Principal Software Engineer
Arcot Systems
(408) 969-6124
"The Borg?  Sounds Swedish..."

---

---

From: "David Taylor" <[email-masked]>
Date: Fri, 15 Jun 2001 07:40:01 +1000

> client could not talk to a server that allowed both SHA and blowfish.

I wasn't thinking very hard when I wrote the message. What you say makes
sense, and the paper they pointed me to mentioned OpenBSD using the scheme
for passwords, so it is probably as you say.

I could still put the selection mechanism there, but define SHA-1 as the
only option for now. It will add a single byte to the structure (if it's a
small enum), and should not be difficult.

My question was more along the lines of "is it possible that SRP will use
different password hashing schemes in future?"

Regards,
David.

---