Subject: [Cfrg] security of HMAC

From: "Steven M. Bellovin" <[email-masked]>
Date: Mon, 10 Jul 2006 12:24:40 -0400

Folks may want to read http://eprint.iacr.org/2006/187 and
http://eprint.iacr.org/2006/043 on the security of HMAC.  (My thanks to
ekr for sending me those links.)

		--Steven M. Bellovin, http://www.cs.columbia.edu/~smb

_______________________________________________
Cfrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/cfrg

---

From: [email-masked]
Date: Mon, 10 Jul 2006 12:54:50 -0400 (EDT)

There were two potentially interesting develoments at Eurocrypt: A paper
presented by John Kelsey of NIST on how any collisions in a hash fuction
can be exploited and a talk at the Rump Session by Hideki Imai of the
Information-Technology Promotion Agency, Japan, on new collisions in
58-round SHA-1 using Groebner bases. Imai projected that previous
extimates of how long it would take to find full SHA-1 collisions need to
be reconsidered.

Rich Graveman

---

From: Daniel Brown <[email-masked]>
Date: Tue, 18 Jul 2006 18:13:33 -0400

Is it correct that the first paper is claiming to be able forge HMAC-SHA1 
with work effort 2^53?  If so, should the Cfrg recommend migrating away 
from HMAC-SHA1 (at least for message authentication) more rapidly, given 
that most IETF WGs are operating under the advice that the SHA1 attacks 
are not expected to have any impact on HMAC-SHA1, of which this paper 
would seem to disabuse.

Thanks,

Dan Brown
(905) 501-3857
http://www.certicom.com

"Steven M. Bellovin" <[email-masked]> wrote on 07/10/2006 12:24:40

---

From: Scott Fluhrer <[email-masked]>
Date: Tue, 18 Jul 2006 15:59:14 -0700 (PDT)

On Tue, 18 Jul 2006, Daniel Brown wrote:

> with work effort 2^53?

No, the results in table 3 claims the 2^53 forgery result applies to a 
reduced round version of SHA-1 (34 rounds, rather than the full 80).

This appears to be an impressive result, but it is not a cause to panic.

>                        If so, should the Cfrg recommend migrating away

---

From: Daniel Brown <[email-masked]>
Date: Wed, 19 Jul 2006 11:54:57 -0400

> This appears to be an impressive result, but it is not a cause to panic.

Thanks, I didn't read it right at all (and guess I panicked when I saw 80 
rounds in the left column and mistakenly took it to mean how many rounds 
were being attacked).

Anyway, I still ask: is this result any cause to accelerate migration away 
from HMAC-MD4/SHA1 (without panicking)?  For example, should new IETF 
specifications allow HMAC-MD5/SHA1 only for backwards interop purposes? 
This impressive result seems to establish an erosion in the security of 
the HMAC that heretofore HMAC was thought to be free from, so it should be 
at least be considered when choosing a MAC.

---

From: Scott Fluhrer <[email-masked]>
Date: Wed, 19 Jul 2006 10:19:43 -0700 (PDT)

On Wed, 19 Jul 2006, Daniel Brown wrote:

> from HMAC-MD4/SHA1 (without panicking)?

You, of course, meant to type HMAC-MD5 -- this paper would give ample 
justification for moving away from HMAC-MD4, had anyone in the IETF been 
silly enough to use it.

>                                         For example, should new IETF

My opinion is that it isn't.  After all, the version they attacked was 
severely weakened; less than half the rounds.  An equivilent result 
against 128 bit AES would be against a four round version.  We already 
have results against AES reduced to four rounds, no one is seriously 
concerned that that result implies that we should migrate from AES.

-- 
scott