Subject: [TLS] Re: SHA-1 collisions found

From: Jeff Williams <[email-masked]>
Date: Fri, 18 Feb 2005 00:06:23 -0800

Austin,

  I never said that DES had anything to do with identity theft directly.
So such a mischaracterization is of your own interpratation of what
I did say. What I did say was the following again: "it is clear that
moving away from DES/3DES and SHA-1 is necessary and IMHO
amongst a growing number of other security professionals as well
as the NIST, long overdue due to identity theft and other security
related very real concerns.."

  Yes your right that 3DES is not directly used to authenticate identities,
and breaks in SHA-1 can't be used directly to forge identities as you
state it in your remarks.  However indirectly and/or as result in the
use of cybersuites in TLS/SSL where SHA-1 is one hash used and
3DES is included, the "Stealing" of identities and/or misuse can be
achieved...  Hence, the movement away from the SHA-1 hash as
well as BTW it's siblings SHA-256 and SHA-512 would be advisible
as soon as can be achieved.  The NIST has already recomended
moving away from DES and 3DES as I believe you know...
So the sooner a moving away can be achieved, the lessor of a
chance a panic approach will ensue.

Austin R. wrote:

> Jeff,
> I'm not going to waste the rest of the listserv's time with this as we did
> last time when everyone on the listserv told you that you were wrong...but
> you're wrong.  And frankly it's frustrating to hear you keep saying things
> that are plainly wrong and confuse people.  3DES has nothing to do with
> identity theft because it's not used to authenticate identity, and people
> can't forge identities through breaks in SHA-1 yet either...and won't be
> able to for some time in the far future.  Reread what the guy AT NIST wrote
> the listserv regarding that.  There are no reported weaknesses in 3DES
> either Jeff.
>
> Also...I can't seen to find your company anywhere, your claim to know Prof.
> Hawking was invalidated by his student assistant that I contacted, and in
> general it seems like you're just BSing most of what you say.  If you want
> to go on a listserv and act like you know what you're talking about when you
> don't, I really can't stop you (obviously)...but at least have the decency
> not to scare others who don't know things that you say are BS.
>
> ----------------------------------------------------------------------
> Gavon (Austin) Renfroe
> BSEE, BA Math, University of Texas at Austin Class of 2004
> Emory School of Law Class of 2007
>
> -----Original Message-----
> From: Information Security Committee [mailto:[email-masked]] On
> Behalf Of Jeff Williams
> Sent: Friday, February 18, 2005 12:59 AM
> To: [email-masked]
> Subject: Re: SHA-1 collisions found
>
> Richard and all,
>
>   No offense, but it is clear that moving away from DES/3DES and
> SHA-1 is necessary and IMHO amongst a growing number of other
> security professionals as well as the NIST, long overdue due to identity
> theft and other security related very real concerns..  If my and/or others
> "Language" is seemingly alarmist or "Scary" to some folks, than that
> may be a good thing so as to aid in facilitate and/or expedite said
> migration away from DES/3DES as well as SHA-1.  The IETF on
> a number of forums I am a participant on to one degree or activity
> or another are also very interested now given the increasing weakness
> noticed and reported in DES/3DES and now SHA-1 and advising
> to new Hash development, and I view this as a positive thing...
>
> Guida, Richard [JJCUS] wrote:
>
> > Jeff, this is a reprise of the 3DES issue regarding the term "broken."  If
> > you wish to get on the witness stand and testify that SHA-1 is "broken,"
> > that is your right.  I would look forward to helping opposing counsel
> > cross-examine you.  We all understand the need to migrate to SHA-256 or
> > better as soon as practical; there is no need for hyperbole, which may
> > unduly frighten people into not using digital signatures or cryptographic
> > techniques "until all of this gets sorted out."  Believe it or not, that
> is
> > how some people actually think.  So let's please be measured in our use of
> > words.
> >
> > Here is an excerpt from a separate post on the SAAG mail-list by Peter
> > Guttman which I think well captures the situation; note the first sentence
> > in the final paragraph:
> >
> > <snip>
> >
> > I think it'd be better to wait a bit to get the full details.  Here's a
> > boilerplate summary I've been sending out to people who have mailed me
> about
> > this (personal opinion disclaimer, etc etc):
> >
> > - It only affects the use of SHA-1 as a hash function, not as a PRF or
> HMAC,
> >   so the core of SSH, SSL/TLS, etc etc are unaffected.
> >
> > - I've seen one report that it only affects the compression function and
> not
> >   the full hash function, which sounds plausible.  SHA-1 (and indeed all
> of
> >   the MD4-type UFN hashes) use a core compression function and then
> perform
> >   extra operations for the full hash function, so finding collisions in
> the
> >   full hash is somewhat more difficult than just the compression function.
> >
> > - It takes 2^69 ops on average to find a second input value that produces
> > the
> >   same output as the first one (the ambiguous phrasing here is meant to
> >   indicate that probably what's meant is that the compression function
> >   produces the same output rather than the full SHA-1 hash producing the
> > same
> >   output, see above).  The second input value can't be chosen by the
> > attacker,
> >   so the chances of forging a signature on structured data like a
> > certificate
> >   or CMS/PGP message are fairly remote.
> >
> > So while it's a very interesting result, it's more a hint to consider
> moving
> > to something else rather than time to hit the panic button.  RIPEMD-160
> > still
> > looks fairly secure, my gut feeling is that its dual-path construction is
> > safer than the SHA-1 derived SHA-256 et al, but I suspect that in the
> light
> > of
> > the current work on attacking UFN-based designs we'll be seeing a pile of
> > new
> > non-UFN hash functions in the same way that differential cryptanalysis
> > spurred
> > a burst of work on new ciphers.
> >
> > <snip>
> >
> > Richard A. Guida
> > Director, Information Security
> >
> > Johnson & Johnson
> > Room GS8217
> > 410 George Street
> > New Brunswick, New Jersey  08901
> > Phone:  732 524 3785
> >
> > -----Original Message-----
> > From: Jeff Williams [mailto:[email-masked]]
> > Sent: Thursday, February 17, 2005 6:09 AM
> > To: [email-masked]
> > Subject: Re: SHA-1 collisions found
> >
> > Austina and all,
> >
> >   I know and knew exactly what I said.  SHA-1 IS broken, no
> > doubt about it...
> >
> >   And no, it is not just "Found" Collisions.  If you read the peace
> > I originally provided CAREFULLY you would know that.. Such
> > characterizations is what in some quarters of the security and crypto
> > professionals why some if not many breaches occur and compromises
> > of some if not allot of significant damage and sometimes not noticed
> > or recognized for a significant amount of time...
> >
> >  Also see:
> > http://pluralsight.com/blogs/keith/archive/2005/02/16/5907.aspx
> >
> > Austin R. wrote:
> >
> > > Jeff,
> > > Again...SHA-1 is not broken.  Broken means that you have a way to
> extract
> > > the plaintext from it, or at least reliably change the contents.  SHA-1
> > has
> > > just become the focus of current attempts of cryptanalysis, and as a
> > result
> > > (that and because it's aging like any hash) people have found
> collisions.
> > > As I have explicitly said numerous times, be careful in your terminology
> > > because this: "SHA-1 is broken without a doubt" is wrong.  Also, realize
> > > that saying it's not is not "rhetorical backpedalling by some of [your]
> > > colleagues," they're just correctly interpreting what collisions mean.
> I
> > > won't go back into this, but all hashes have collisions.  That's how
> > hashes
> > > work Jeff...it's mathematics.  The "breaking" involves being able to
> > change
> > > the contents or extract from the hash, which you as of now cannot still
> > do.
> > >
> > > ----------------------------------------------------------------------
> > > Gavon (Austin) Renfroe
> > > BSEE, BA Math, University of Texas at Austin Class of 2004
> > > Emory School of Law Class of 2007
> > >
> > > -----Original Message-----
> > > From: Information Security Committee [mailto:[email-masked]] On
> > > Behalf Of Jeff Williams
> > > Sent: Thursday, February 17, 2005 2:13 AM
> > > To: [email-masked]
> > > Subject: Re: SHA-1 collisions found
> > >
> > > Chas and all,
> > >
> > >   Adi is right, not all collisions indicate a hash is broken. However
> with
> > > the number of collisions now known and more expected very soon,
> > > SHA-1 is broken without a doubt, despite rhetorical backpedalling by
> > > some of my colleagues..  The evidance is overwhelming and expanding
> > > almost daily regarding SHA-1 and other hashes...
> > >
> > > Merrill, Charles wrote:
> > >
> > > > (disclaimer--I am an attorney, not qualified to comment on crypto).
> > > Yesterday at the morning Crypto session here at the RSA conference, Adi
> > > Shamir commented on the 69 rounds announcement by the Chinese team, to
> put
> > > it in practical context. He reminded that a hash "collision" is not the
> > same
> > > as functionally "broken". A collision is a pair of messages that share
> the
> > > same hash result with an astronomical  probability of having no
> practical
> > > resemblance to each other -- something far less than demonstration of
> the
> > > ability to work the one way function backward. Nonetheless he advocated
> > > continued progress toward stronger hash algrithms,  remarkimg that some
> > day
> > > collisions might become grist for an attorney trying to undermine a pki
> > > digital signature with expert testimony to the effect that there are
> > > theoretical chinks in the one-way-ness of the hash that is incorporated
> in
> > > the digital signature. Chas
> > > >
> > > >  -----Original Message-----
> > > > From:   Jeff Williams [mailto:[email-masked]]
> > > > Sent:   Wed Feb 16 02:10:22 2005
> > > > To:     [email-masked]
> > > > Subject:        SHA-1 collisions found
> > > >
> > > > All,
> > > >
> > > >   SHA-1 broken, again..
> > > >
> > > > http://www.schneier.com/blog/archives/2005/02/sha1_broken.html
> > > >
> > > > Excerpts:
> > > >
> > > > SHA-1 has been broken. Not a reduced-round version. Not a simplified
> > > >  version. The real thing.
> > > >
> > > > The research team of Xiaoyun Wang, Yiqun Lisa Yin, and Hongbo Yu
> > > > (mostly from Shandong University in China) have been quietly
> circulating
> > > > a paper announcing their results:
> > > >
> > > > collisions in the the full SHA-1 in 2**69 hash operations, much less
> > > > than the brute-force attack of 2**80 operations based on the hash
> > > > length.
> > > >
> > > > collisions in SHA-0 in 2**39 operations.
> > > >
> > > > collisions in 58-round SHA-1 in 2**33 operations.
> > > >
> > > > This attack builds on previous attacks on SHA-0 and SHA-1, and is a
> > > > major, major cryptanalytic result. It pretty much puts a bullet into
> > > > SHA-1 as a hash function for digital signatures (although it doesn't
> > > > affect applications such as HMAC where collisions aren't important).
> > > >
> > > > Regards
> > > >
> > > > --
> > > > Jeffrey A. Williams
> > > > Spokesman for INEGroup LLA. - (Over 134k members/stakeholders strong!)
> > > > "Be precise in the use of words and expect precision from others" -
> > > >     Pierre Abelard
> > > >
> > > > "If the probability be called P; the injury, L; and the burden, B;
> > > > liability depends upon whether B is less than L multiplied by
> > > > P: i.e., whether B is less than PL."
> > > > United States v. Carroll Towing  (159 F.2d 169 [2d Cir. 1947]
> > > > ===============================================================
> > > > Updated 1/26/04
> > > > CSO/DIR. Internet Network Eng. SR. Eng. Network data security
> > > > IDNS. div. of Information Network Eng.  INEG. INC.
> > > > E-Mail [email-masked]
> > > >  Registered Email addr with the USPS
> > > > Contact Number: 214-244-4827
> > > >
> > > > Your e-mail address will only be used within the ABA and its entities.
> > > > We do not sell or rent e-mail addresses to anyone outside the ABA.
> > > >
> > > > To change your e-mail address or remove your name from any future
> > general
> > > distribution e-mails you can call us at 1-800-285-2221 or write to:
> > > >
> > > >    American Bar Association
> > > >    Service Center
> > > >    321 N Clark Street
> > > >    Chicago, IL  60610
> > > >
> > > > To unsubscribe send the following in the body of a message to
> > > > [email-masked]  - unsubscribe st-isc
> > > >
> > > > To review our privacy statement, go to
> > > > http://www.abanet.org/privacy_statement.html.
> > > >
> > > > This email message from the law firm of McCarter & English, LLP is for
> > the
> > > sole use of the intended recipient(s)and may contain confidential and
> > > privileged information. Any unauthorized review, use, disclosure or
> > > distribution is prohibited. If you are not the intended recipient,
> please
> > > contact the sender by reply email(or [email-masked]) and destroy
> > all
> > > copies of the original message.
> > > >
> > > > Your e-mail address will only be used within the ABA and its entities.
> > > > We do not sell or rent e-mail addresses to anyone outside the ABA.
> > > >
> > > > To change your e-mail address or remove your name from any future
> > general
> > > distribution e-mails you can call us at 1-800-285-2221 or write to:
> > > >
> > > >    American Bar Association
> > > >    Service Center
> > > >    321 N Clark Street
> > > >    Chicago, IL  60610
> > > >
> > > > To unsubscribe send the following in the body of a message to
> > > > [email-masked]  - unsubscribe st-isc
> > > >
> > > > To review our privacy statement, go to
> > > > http://www.abanet.org/privacy_statement.html.
> > >
> > > Regards,
> > >
> > > --
> > > Jeffrey A. Williams
> > > Spokesman for INEGroup LLA. - (Over 134k members/stakeholders strong!)
> > > "Be precise in the use of words and expect precision from others" -
> > >     Pierre Abelard
> > >
> > > "If the probability be called P; the injury, L; and the burden, B;
> > > liability depends upon whether B is less than L multiplied by
> > > P: i.e., whether B is less than PL."
> > > United States v. Carroll Towing  (159 F.2d 169 [2d Cir. 1947]
> > > ===============================================================
> > > Updated 1/26/04
> > > CSO/DIR. Internet Network Eng. SR. Eng. Network data security
> > > IDNS. div. of Information Network Eng.  INEG. INC.
> > > E-Mail [email-masked]
> > >  Registered Email addr with the USPS
> > > Contact Number: 214-244-4827
> > >
> > > Your e-mail address will only be used within the ABA and its entities.
> > > We do not sell or rent e-mail addresses to anyone outside the ABA.
> > >
> > > To change your e-mail address or remove your name from any future
> general
> > > distribution e-mails you can call us at 1-800-285-2221 or write to:
> > >
> > >    American Bar Association
> > >    Service Center
> > >    321 N Clark Street
> > >    Chicago, IL  60610
> > >
> > > To unsubscribe send the following in the body of a message to
> > > [email-masked]  - unsubscribe st-isc
> > >
> > > To review our privacy statement, go to
> > > http://www.abanet.org/privacy_statement.html.
> > >
> > > Your e-mail address will only be used within the ABA and its entities.
> > > We do not sell or rent e-mail addresses to anyone outside the ABA.
> > >
> > > To change your e-mail address or remove your name from any future
> general
> > distribution e-mails you can call us at 1-800-285-2221 or write to:
> > >
> > >    American Bar Association
> > >    Service Center
> > >    321 N Clark Street
> > >    Chicago, IL  60610
> > >
> > > To unsubscribe send the following in the body of a message to
> > > [email-masked]  - unsubscribe st-isc
> > >
> > > To review our privacy statement, go to
> > > http://www.abanet.org/privacy_statement.html.
> >
> > Regards,
> >
> > --
> > Jeffrey A. Williams
> > Spokesman for INEGroup LLA. - (Over 134k members/stakeholders strong!)
> > "Be precise in the use of words and expect precision from others" -
> >     Pierre Abelard
> >
> > "If the probability be called P; the injury, L; and the burden, B;
> > liability depends upon whether B is less than L multiplied by
> > P: i.e., whether B is less than PL."
> > United States v. Carroll Towing  (159 F.2d 169 [2d Cir. 1947]
> > ===============================================================
> > Updated 1/26/04
> > CSO/DIR. Internet Network Eng. SR. Eng. Network data security
> > IDNS. div. of Information Network Eng.  INEG. INC.
> > E-Mail [email-masked]
> >  Registered Email addr with the USPS
> > Contact Number: 214-244-4827
> >
> > Your e-mail address will only be used within the ABA and its entities.
> > We do not sell or rent e-mail addresses to anyone outside the ABA.
> >
> > To change your e-mail address or remove your name from any future general
> > distribution e-mails you can call us at 1-800-285-2221 or write to:
> >
> >    American Bar Association
> >    Service Center
> >    321 N Clark Street
> >    Chicago, IL  60610
> >
> > To unsubscribe send the following in the body of a message to
> > [email-masked]  - unsubscribe st-isc
> >
> > To review our privacy statement, go to
> > http://www.abanet.org/privacy_statement.html.
> >
> > Your e-mail address will only be used within the ABA and its entities.
> > We do not sell or rent e-mail addresses to anyone outside the ABA.
> >
> > To change your e-mail address or remove your name from any future general
> distribution e-mails you can call us at 1-800-285-2221 or write to:
> >
> >    American Bar Association
> >    Service Center
> >    321 N Clark Street
> >    Chicago, IL  60610
> >
> > To unsubscribe send the following in the body of a message to
> > [email-masked]  - unsubscribe st-isc
> >
> > To review our privacy statement, go to
> > http://www.abanet.org/privacy_statement.html.
>
> Regards,
>
> --
> Jeffrey A. Williams
> Spokesman for INEGroup LLA. - (Over 134k members/stakeholders strong!)
> "Be precise in the use of words and expect precision from others" -
>     Pierre Abelard
>
> "If the probability be called P; the injury, L; and the burden, B;
> liability depends upon whether B is less than L multiplied by
> P: i.e., whether B is less than PL."
> United States v. Carroll Towing  (159 F.2d 169 [2d Cir. 1947]
> ===============================================================
> Updated 1/26/04
> CSO/DIR. Internet Network Eng. SR. Eng. Network data security
> IDNS. div. of Information Network Eng.  INEG. INC.
> E-Mail [email-masked]
>  Registered Email addr with the USPS
> Contact Number: 214-244-4827
>
> Your e-mail address will only be used within the ABA and its entities.
> We do not sell or rent e-mail addresses to anyone outside the ABA.
>
> To change your e-mail address or remove your name from any future general
> distribution e-mails you can call us at 1-800-285-2221 or write to:
>
>    American Bar Association
>    Service Center
>    321 N Clark Street
>    Chicago, IL  60610
>
> To unsubscribe send the following in the body of a message to
> [email-masked]  - unsubscribe st-isc
>
> To review our privacy statement, go to
> http://www.abanet.org/privacy_statement.html.

--
Jeffrey A. Williams
Spokesman for INEGroup LLA. - (Over 134k members/stakeholders strong!)
"Be precise in the use of words and expect precision from others" -
    Pierre Abelard

"If the probability be called P; the injury, L; and the burden, B;
liability depends upon whether B is less than L multiplied by
P: i.e., whether B is less than PL."
United States v. Carroll Towing  (159 F.2d 169 [2d Cir. 1947]
===============================================================
Updated 1/26/04
CSO/DIR. Internet Network Eng. SR. Eng. Network data security
IDNS. div. of Information Network Eng.  INEG. INC.
E-Mail [email-masked]
 Registered Email addr with the USPS
Contact Number: 214-244-4827

_______________________________________________
TLS mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/tls

---

From: Eric Rescorla <[email-masked]>
Date: Thu, 17 Feb 2005 22:32:55 -0800

Jeff Williams <[email-masked]> writes:
> achieved... 
This strikes me as a dubious claim given our current level of
cryptoanalytic sucess. In particular, it appears unlikely that the
collision attacks on SHA-1 can be used to mount a successful attack on
either the HMAC-SHA function used for message integrity in SSL/TLS or
the HMAC-SHA-based PRF function used to generate the keying
material. The only plausible point of attack on SSL/TLS at the present
time is against the certificate infrastructure and even that looks to
require a very large amount of effort with only a modest probability
of success.

I don't know of any useful attacks on 3DES in particular that
could plausibly be used to perform identity theft. (The CBC-based
attacks don't depend on 3DES and can also be used against AES.)

> Hence, the movement away from the SHA-1 hash as
> as soon as can be achieved. 
It's not actually clear that SHA-256 will be more resistant to
this line of cryptanalyis.

-Ekr

---

From: Jeff Williams <[email-masked]>
Date: Fri, 18 Feb 2005 04:01:08 -0800

Eric and all,

> require a very large amount of effort with only a modest probability

 Agreed to a point to your reasoned response here.  But not entirely
for reasons I believe I have already articulated as it appears have
others.  I would think it wise to address this problem form a worst
case point of view than otherwise as the latter has potentially very
damaging consequences...

> attacks don't depend on 3DES and can also be used against AES.)

  No attacks/hacks I know of in particular have been directed to
perform identity theft either, yet.

> this line of cryptanalyis.

  That was my point, as I believe NIST has been discovering...

Regards,