Subject: [secdir] Secdir review of draft-turner-md2-to-historic-05

From: Catherine Meadows <[email-masked]>
Date: Sat, 16 Oct 2010 14:36:34 -0400

I have reviewed this document as part of the security directorate's 
ongoing effort to review all IETF documents being processed by the 
IESG.  These comments were written primarily for the benefit of the 
security area directors.  Document editors and WG chairs should treat 
these comments just like any other last call comments.

This document recommends that the MD2 hash algorithm be moved to historic status and gives
the rationale for doing this.  The reasons are mainly security-related, given that the algorithm
has been shown not to be collision-free and is vulnerable to pre-image attacks.  Performance is also an
issue.  The impact is minimal, given that support for MD2 in the standards that refer to it is either optional or
discouraged.

I have no problems with the decision or rationale.  I agree, as I am sure that everyone else does, the MD2
should be retired.  

I do have one minor recommendation though about the rationale: in section 2 (the Rationale section),
you say that MD2 has been shown to not be collision-free and is vulnerable to pre-image attacks.  The Rationale
appears to give both these concerns equal value. But in Section 6 (Security Considerations), you say
that the most successful collision attacks against MD2 are not significantly better than the birthday attack,
and the real security problems with MD2 have to do with its vulnerability to pre-image attacks.  It seems to me that
this reasoning should be reflected in the Rationale.

Catherine Meadows
Naval Research Laboratory
Code 5543
4555 Overlook Ave., S.W.
Washington DC, 20375
phone: 202-767-3490
fax: 202-404-7942
email: [email-masked]

---

From: Sean Turner <[email-masked]>
Date: Mon, 18 Oct 2010 15:02:56 -0400

Catherine,

Thanks for your review.

How about I make the following two changes:

1) In Section 1, add something to provide a better characterization of 
the collision-resistance:

OLD:

  Since its publication, MD2 has been shown to not be collision-free
  [ROCH1995][KNMA2005][ROCH1997] and shown to have successful
  pre-image attacks [KNMA2005][MULL2004][KMM2010].

NEW:

  Since its publication, MD2 has been shown to not be collision-free
  [ROCH1995][KNMA2005][ROCH1997], albeit successful pre-image attacks
  for properly implement MD2 are not that damaging. MD2 has also been
  shown to have successful pre-image and second-preimage attacks
  [KNMA2005[MULL2004][KMM2010].

2) In section 6, align the last sentence of the second paragraph and 
the 1st sentence of paragraph 3:

OLD:

  .., which is not significantly better than the birthday attack.

  Even though collision attacks on MD2 are not more powerful than
  the  birthday attack, MD2 was found not to be one-way...

NEW:

  .., which is not significantly better than the birthday attack.

  Even though collision attacks on MD2 are not significantly more
  powerful than the birthday attack, MD2 was found not to be
  one-way...

spt

On 10/16/10 2:36 PM, Catherine Meadows wrote:
> _______________________________________________
> secdir mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/secdir
>

---

From: Catherine Meadows <[email-masked]>
Date: Mon, 18 Oct 2010 15:16:08 -0400

Sean,

Yes, this looks much better, although I think that for

Since its publication, MD2 has been shown to not be collision-free
[ROCH1995][KNMA2005][ROCH1997], albeit successful pre-image attacks
for properly implement MD2 are not that damaging. 

what you really meant to say was

Since its publication, MD2 has been shown to not be collision-free
[ROCH1995][KNMA2005][ROCH1997], albeit successful collision  attacks
for properly implemented MD2 are not that damaging. 

Is that correct?

Cathy

On Oct 18, 2010, at 3:02 PM, Sean Turner wrote:

> 1) In Section 1, add something to provide a better characterization of the collision-resistance:
> 
> OLD:
> 
> 2) In section 6, align the last sentence of the second paragraph and the 1st sentence of paragraph 3:
> 
> OLD:
> 

Catherine Meadows

---

From: Sean Turner <[email-masked]>
Date: Mon, 18 Oct 2010 15:26:45 -0400

drat - yes the albeit phrase should be about the collision attacks not 
the pre-image attacks.

spt

On 10/18/10 3:16 PM, Catherine Meadows wrote:
>>> the rationale for doing this. The reasons are mainly
>>> security-related, given that the algorithm
>>> has been shown not to be collision-free and is vulnerable to
>>> pre-image attacks. Performance is also an
>>> issue. The impact is minimal, given that support for MD2 in the
>>> standards that refer to it is either optional or
>>> discouraged.
>>>
>>> you say that MD2 has been shown to not be collision-free and is
>>> vulnerable to pre-image attacks. The Rationale
>>> that the most successful collision attacks against MD2 are not
>>> significantly better than the birthday attack,
>>> and the real security problems with MD2 have to do with its
>>> vulnerability to pre-image attacks. It seems to me that
>>> <mailto:[email-masked]>
>>>
>>> [email-masked] <mailto:[email-masked]>
> <mailto:[email-masked]>
>