Subject: Re: [saag] Fwd: NIST releases Draft FIPS 180-4, Secure Hash Standard (SHS)

From: Sean Turner <[email-masked]>
Date: Wed, 02 Mar 2011 13:26:41 -0500

Well this draft is in the RFC editor queue:

http://datatracker.ietf.org/doc/draft-turner-sha0-sha1-seccon/

spt

On 3/2/11 12:20 PM, Phillip Hallam-Baker wrote:
> What is the SAAG view as to what crypto algorithms are appropriate for
> use at present?
>
> The reason I am asking is that this is being discussed in DANE and I
> am seeing a lot of argument by analogy. The assumption seems to be
> that since the legacy TLS infrastructure uses SHA1 and we cannot
> currently change that because there is a huge amount of legacy that
> DANE can also use SHA1 as it is 'plenty'.
>
> My view is that the Security Area Directorate should send a pretty
> clear message that use of SHA1 is now deprecated and that:
>
> 1) Support for SHA1 should not be approved in future protocols without
> a very compelling use case
>
> 2) New protocols should require support for SHA2-256 at the least.
>
> 3) Existing protocols should plan for a transition from SHA1 to a
> stronger hash in a manner that is downwards compatible.
>
>
> I don't think any of these is particularly controversial in the
> security area. Although it must be pointed out that at present we do
> not have a viable strategy for transitioning from SHA1 to SHA2.
>
> None of my customers is going to buy a certificate for SHA2 unless the
> protocols allow a server to also support legacy browsers without SHA2
> support. Similarly, there is no value to introducing support for SHA2
> in new browsers, the only way to get value is by withdrawing SHA1
> support.
>
>
> There are several approaches that could be used to address this issue
> but none that seem to satisfy X.509 purists.
>
>
> On Sun, Feb 13, 2011 at 10:35 AM, Sean Turner<[email-masked]>  wrote:
>> -------- Original Message --------
>> Subject:        NIST releases Draft FIPS 180-4, Secure Hash Standard (SHS)
>> Date:   Fri, 11 Feb 2011 12:10:20 -0500
>>
>> NIST announces the release of Draft Federal Information Processing
>> Standard (FIPS) 180-4, Secure Hash Standard (SHS).
>> <http://csrc.nist.gov/publications/drafts/fips180-4/Draft-FIPS180-4_Feb2011.pdf>Draft
>> FIPS 180-4 is a proposed revision of FIPS 180-3. Draft FIPS 180-4 adds a
>> general procedure for creating an initialization hash value and two
>> additional secure hash algorithms: SHA-512/224 and SHA-512/256, and
>> removes a requirement that padding must be done before hash computation
>> begins. SHA-512/224 and SHA-512/256 may be more efficient alternatives
>> to SHA-224 and SHA-256, respectively, on platforms that are optimized
>> for 64-bit operations. Removing the restriction on the padding operation
>> in the secure hash algorithms will potentially create more flexibility
>> and efficiency in implementing the secure hash algorithms in many
>> computer network applications. The Federal Register Notice (FRN) of this
>> publication is located _here
>> <http://csrc.nist.gov/publications/drafts/fips180-4/FRN_Draft-FIPS180-4.pdf>_.
>> Examples of the implementation of the secure hash algorithms SHA-1,
>> SHA-224, SHA-256, SHA-384, SHA-512, SHA-512/224 and SHA-512/256, can be
>> found at http://www.nist.gov/CryptoToolkitExamples.
>>
>> _______________________________________________
>> saag mailing list
>> [email-masked]
>> https://www.ietf.org/mailman/listinfo/saag
>>
>
>
>

---

From: Paul Hoffman <[email-masked]>
Date: Wed, 02 Mar 2011 11:36:33 -0800

> DANE can also use SHA1 as it is 'plenty'.

This is a complete mischaracterization of the recent discussion on DANE. 
People should look at the archives 
(<http://www.ietf.org/mail-archive/web/keyassure/current/maillist.html>) 
for the past two days instead of believing Phill's description.

In specific, one person (Martin Rex) said that SHA-256, not SHA-1, was 
"plenty". No one has made any statements that back up Phill's supposed 
"assumption" other than to note that SHA-1 is still specified in recent 
RFCs.

FWIW, I believe that Martin said that SHA-256 was plenty was responding 
to Phill's earlier message on the thread that said "We really do need 
SHA2 in here as a MUST" without specifying which algorithms of SHA2 
needed to be mandated. That is, I think Martin was saying that SHA-256 
was plenty, and we did not need to mandate SHA-384 or SHA-512.

--Paul Hoffman

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Wed, 2 Mar 2011 12:20:03 -0500

-- 
Website: http://hallambaker.com/