Subject: RE: [RPSEC] Minutes and Presentations from Paris are now Posted...

From: "Vishwas Manral" <[email-masked]>
Date: Mon, 15 Aug 2005 22:01:05 -0700

Hi Steve,

> Steve Kent: The keyed MD5 and HMAC constructs in current use are 
> not vulnerable to the sort of hash function attacks that Russ cited
> in his presentation. These attacks allow someone to construct distinct
> bit strings that yield the same hash value, but do not allow someone 
> to create a distinct bit string that maps to a has value chosen by 
> someone else, much less a hash value that is chosen by someone else 
> and that is a function of a secret key.
What you are saying is that although "Birthday attacks" are possible,
they may not be such a problem in the case described in the draft?

I guess your concern is regarding: -

"While there are no openly published attacks on that mechanism, some
reports [Dobb96a, Dobb96b] create concern about the ultimate strength of
the MD5 cryptographic hash function", 
which we have taken from the
http://www.ietf.org/internet-drafts/draft-rja-ripv2-auth-01.txt draft.

Thanks,
Vishwas
-----Original Message-----
From: Stephen Kent [mailto:[email-masked]] 
Sent: Thursday, August 11, 2005 1:42 AM
To: Vishwas Manral
Cc: [email-masked]
Subject: RE: [RPSEC] Minutes and Presentations from Paris are now
Posted...

The minutes should say something along the lines of:

Efficient BGP security ...

Steve Kent: S-BGP does not call for issuing CRL or using OCSP to deal 
with revocation for RAs. RAs are assumed to have limited lifetimes, 
e.g., 1 day, and thus need not be revoked explicitly.

Issues with RP Security Mechanisms ...

Steve Kent: The keyed MD5 and HMAC constructs in current use are not 
vulnerable to the sort of hash function attacks that Russ cited in 
his presentation. These attacks allow someone to construct distinct 
bit strings that yield the same hash value, but do not allow someone 
to create a distinct bit string that maps to a has value chosen by 
someone else, much less a hash value that is chosen by someone else 
and that is a function of a secret key.

_______________________________________________
RPSEC mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/rpsec

---

From: "Steven M. Bellovin" <[email-masked]>
Date: Tue, 16 Aug 2005 11:11:11 -0400

In message <[email-masked]>, "Vis
>http://www.ietf.org/internet-drafts/draft-rja-ripv2-auth-01.txt draft.

He's referring to Wang's attacks -- she has found 
collisions in MD5 and shown how to do so for SHA1.  See
http://th.informatik.uni-mannheim.de/people/lucks/HashCollisions/
for an explanation.  *But* -- the attacks don't apply to these hash 
functions when used as part of HMAC.

		--Steven M. Bellovin, http://www.cs.columbia.edu/~smb