Subject: Re: CGA issues

From: <[email-masked]>
Date: Mon, 10 May 2004 13:36:15 +0300

> Still, I don't see the value in having the subnet prefix
> in the hash, and there's still the issue of address
> rewriting.
> 
> Are there any attacks that can be fended off this way?
> If it's just a privacy thing I don't think that's enough
> justification, as it's already possible to generate a new
> hash based on an existing key by selecting a new 
> "modifier" value. The only problem here is that this is
> more expensive when a "Sec" is in effect. But that's 
> pretty much a feature rather than a downside.

There is a specific attack that the prefix counters.
Basically, the problem is in the number of available
bits for the IID, which is pretty large but quite as
much as one would perhaps hope to have in the cryptographic
sense. Tuomas' "Sec" bits defend against brute force
attacks, and the inclusion of the prefix defends
against precomputation.

Basically, if the prefix is not included in the
address genereration, the bad guys -- like some
three letter organization -- could generate a table
of all CGAs. I did the math about a couple of years
ago, and it turned out that at that time, you would
have needed about 10 WTCs worth of office space
to house the tape machines that hold the table. But
technology is advancing, so it might have become
feasible at some point. Now, with the prefix included
in the hash, you'd have to have this much data for
_each prefix_.

> BTW, I'm no statistician and I don't play one on tv,
> but isn't there a significant chance that you're going
> to run into statistical anomalies when searching for a
> SHA-1 hash with a certain number of 0 bits in it? I 
> mean, the chance of getting a SHA-1 with all 0 bits 
> in the lowest 16 bits would be 1 in 65536. But that 
> doesn't automatically mean that if you try 65536 
> times you hit one. Has anyone done the math on this? 

Another question for Tuomas...

--Jari

--------------------------------------------------------------------
To unsubscribe from this list, send email with "UNSUBSCRIBE" in the
body to <[email-masked]>.
Archive: http://standards.ericsson.net/lists/ietf-send/maillist.html
--------------------------------------------------------------------