Subject: Re: [Ipsec] Last Call: 'Cryptographic Algorithm Implementation Requirements For ESP And AH' to Proposed Standard

From: Hugo Krawczyk <[email-masked]>
Date: Thu, 8 Jul 2004 00:20:43 +0300 (IDT)

Draft draft-ietf-ipsec-esp-ah-algorithms-01.txt
specifies HMAC-MD5 as MAY (in the list of authentication algorithms).

Given that 8 years after the invention of HMAC and 8 years after
Dobbertin's attacks on MD5 there is no single piece of evidence (big or
small) against the use of HMAC-MD5, and given that HMAC-MD5 is close to
twice the speed of HMAC-SHA1, then I suggest to upgrade HMAC-MD5 to SHOULD
(it is good to make it available for applications that need the speed,
especially in authentication-only configurations (are there any?)

Just a suggestion. Feel free to ignore.

Hugo

On Wed, 23 Jun 2004, The IESG wrote:

> The IESG has received a request from the IP Security Protocol WG to consider
> the following document:
>
> - 'Cryptographic Algorithm Implementation Requirements For ESP And AH '
>  <draft-ietf-ipsec-esp-ah-algorithms-01.txt> as a Proposed Standard
>
> The IESG plans to make a decision in the next few weeks, and solicits
> final comments on this action.Please send any comments to the
> [email-masked] or [email-masked] mailing lists by 2004-07-07.
>
> The file can be obtained via
> http://www.ietf.org/internet-drafts/draft-ietf-ipsec-esp-ah-algorithms-01.txt
>
>
> _______________________________________________
> Ipsec mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/ipsec
>

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: "Steven M. Bellovin" <[email-masked]>
Date: Wed, 07 Jul 2004 21:31:49 -0400

In message <[email-masked]>
>Just a suggestion. Feel free to ignore.

What did the WG say if/when you raised this during WG Last Call?

		--Steve Bellovin, http://www.research.att.com/~smb

---

From: Hugo Krawczyk <[email-masked]>
Date: Thu, 8 Jul 2004 18:37:42 +0300 (IDT)

>
> What did the WG say if/when you raised this duringWG Last Call?

Unfortunately, I do not follow closely all discussions in the ipsec list,
certainly not in a timely fashion. (After 10 years of ipsec work one gets
tired, don't you agree? :)

Yesterday, July 7th, happened to be the last day of IESG Last Call
period and, while cleaning "old email", I noticed this one.
It may not be worth too much trouble now, so, as said, feel free
to ignore. I just thought that it may be worth providing this feedback.

Hugo

---

From: Bart Preneel <[email-masked]>
Date: Sat, 10 Jul 2004 00:38:51 +0200 (CEST)

Hugo,

I am not so sure that we should strenghten the recommendation for HMAC-MD5.

1) Very few researchers work on hash functions of the MDx-type, and I am
aware of only 1 (not yet published) result on "deviation of randomness"
for these functions; hence the absence of results should not be
interpreted as an indication of security.

2) The little effort that has been spent has resulted in some progress
in the last 2 years:

Saarinen has shown at FSE 2003 that there are some problems when SHA-1
and MD5 would be used as block ciphers (keyed by the message input -
feedforward omitted); collisions have been found for 3 rounds of HAVAL
(Biryukov et al., Asiacrypt 2003); at Crypto 2004 Eli Biham and Rafi Chen
will present near-collisions of SHA-0 (they can also break now 36 rounds
of SHA-1).

None of these attacks forms a direct threat to HMAC-MD5, but these
results show that after 10 years our ability to attack this type of functions
keeps improving; nothing indicates that this progress will stop in
the next years.

3) Nobody has so far attempted to apply algebraic attacks to these
objects; these attacks have been rather successful against stream
ciphers, even if their applicability for block ciphers is currently
unclear.

Once problems are discovered, getting rid of an algorithm is difficult,
which is a reason to be conservative (some components in the banking world
are still in the process of being upgraded from DES to triple-DES).

Finally, it seems that if performance is really an issue, one should
start working on developing a concrete solution using universal
hash function-based constructions.

--Bart

---

From: Hugo Krawczyk <[email-masked]>
Date: Sat, 10 Jul 2004 03:10:07 +0300 (IDT)

Bart,

I am aware of most of the results you mention. Yet, they do not seem to
show any particular weakness of MD5 in the HMAC contest (not more than
SHA-1). Of course, being conservative is a good thing in cryptography but
in this case arguing against HMAC-MD5 may be too conservative.

First, as far as I can see there is no indication that we are closer to a
break of HMAC-MD5 than to a break of HMAC-SHA1 (which is what we are
comparing with).  Second, MAC functions have the nice property that their
break affects security of those using the function AFTER the break, not
those that used it before (this is in sharp contrast to encryption);
therefore having HMAC-SHA1 in an implementation (and this is what ipsec is
demanding by having HMAC-SHA1 as a MUST) allows to move to HMAC-SHA1 if
necessary (i.e. if serious deficiencies of MD5 are found that effect its
security in the context of HMAC). Third, the better speed of MD5 is
significant in some environments (and only for those the use of HMAC-MD5
should be considered).

Finally, I like your last suggestion: a concrete proposal based on
universal hashing for those that need truly fast authentication.
However, I am disappointed by the lack of perceived need for such speeds.
(Say 5-10 times faster than MD5). If anyone has a clear need for such
functions (in particular in the ipsec world) I'd like to know.

Hugo