Subject: Re: [dane] #33: Publish enough information for the client to achieve the security of its favorite digest

From: Phillip Hallam-Baker <[email-masked]>
Date: Fri, 30 Sep 2011 09:19:34 -0400

I agree with Steve, no support for any of the mechanisms.

There are two ways in which SHA-2 can break, gradually or catastrophically.

If the break is gradual we will have 10-20 years to manage a
transition, just like we have had with SHA-1. The reason that I beat
on people mentioning SHA1 in new protocol proposals is not because I
have any immediate concern for security but because we have to start
getting rid of it now if we are going to succeed in completing the
transition in ten years time.

If the break is catastrophic then the ONLY option for remediation will
be out of band updates of executables. So much other stuff will be
being fixed as a result that DANE's problems will be irrelevant.

On Thu, Sep 29, 2011 at 3:40 PM,  <[email-masked]> wrote:
>
>  i agree w/ steve here.  No support for any of the three options.
>
> /bill
>
>
> On Thu, Sep 29, 2011 at 03:44:18AM -0400, Stephen Kent wrote:
>>
>> I am not in favor of any of these three options for dealing
>> with hash alg agility.
>>
>> Steve
>> _______________________________________________
>> dane mailing list
>> [email-masked]
>> https://www.ietf.org/mailman/listinfo/dane
> _______________________________________________
> dane mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dane
>

-- 
Website: http://hallambaker.com/

---

From: Matt McCutchen <[email-masked]>
Date: Fri, 30 Sep 2011 22:44:00 -0700

> transition in ten years time.

As I said, I don't care how many years we have: if the uptake of the TLS
renegotiation fix is any indication, some percentage of sites won't
upgrade before SHA-1 becomes unacceptably weak, and mainstream browsers
will drag their feet on dropping SHA-1 support for fear of losing users
of those sites.  But the TLS handshake at least tries to choose the
strongest algorithm supported by both sides, for some opinion of
strength.  Contrast to X.509 certificate signatures, which by their
nature cannot support downgrade-proof algorithm negotiation; in that
area, the public would be stuck with exposure to SHA-1 for a while, even
when they use upgraded browsers against upgraded servers.

With a small extension to the DANE schema, we can at least avoid
expanding this problem.

> being fixed as a result that DANE's problems will be irrelevant.

Agreed.

-- 
Matt