Subject: Re: CGA issues

From: Iljitsch van Beijnum <[email-masked]>
Date: Tue, 11 May 2004 11:42:05 +0200

On 11-mei-04, at 9:50, Tuomas Aura wrote:

> Supporting privacy by default is certainly not a downside. Instead,
> I would think that any protocol that prevents the use of
> privacy-friendly changing addresses (CGAs or RFC-3041 addresses)
> is seriously flawed.

I wasn't saying there is no value in supporting privacy.

> I don't understand your argument about changing the modifier vs.
> including the prefix in the hash. Both cause the IID to change.
> Changing the modifier is potentially much more expensive. Thus,
> including the prefix makes much more sense.

If all else is the same, yes. But this choice can either make life for 
multi6 a lot harder or make it impossible to deploy SEND in certain 
networks in the future.

>> I mean, the chance of getting a SHA-1 with all 0 bits in the lowest 16
>> bits would be 1 in 65536. But that doesn't automatically mean that if
>> you try 65536 times you hit one. Has anyone done the math on this?

> The median number of iterations is 0.69 * 2^(16*Sec).

So where is the 99th percentile? Or the 99.99th percentile?

--------------------------------------------------------------------
To unsubscribe from this list, send email with "UNSUBSCRIBE" in the
body to <[email-masked]>.
Archive: http://standards.ericsson.net/lists/ietf-send/maillist.html
--------------------------------------------------------------------

---

From: "Tuomas Aura" <[email-masked]>
Date: Tue, 11 May 2004 00:50:09 -0700

Iljitsch wrote:
> Still, I don't see the value in having the subnet prefix in the hash,
> and there's still the issue of address rewriting.
> 
> Are there any attacks that can be fended off this way? If it's just a
> privacy thing I don't think that's enough justification, as it's
> already possible to generate a new hash based on an existing key by
> selecting a new "modifier" value. The only problem here is that this
is
> more expensive when a "Sec" is in effect. But that's pretty much a
> feature rather than a downside.

> BTW, I'm no statistician and I don't play one on tv, but isn't there a
> significant chance that you're going to run into statistical anomalies
> when searching for a SHA-1 hash with a certain number of 0 bits in it?

The median number of iterations is 0.69 * 2^(16*Sec). 
Any "statistical anomaly" in the distribution of the hash 
values would indicate a flaw in the SHA-1 hash function. 

Tuomas