Subject: Protecting Against Weak Hash Algorithms

From: "Santosh Chokhani" <[email-masked]>
Date: Wed, 20 Sep 2006 12:09:53 -0700

As you know the hashing algorithms are in state of flux (We know MD5 is
bad, SHA-1 is beginning to smell and so on).

Also, we know that many relying parties implement many of these
algorithms.

Also, Russ has been talking about making PKIX RFCs algorithm independent
so that algorithms can be easily swapped in and out.

I think we should have a debate on security issues surrounding weak
hashes, specifically relying parties snookered into verifying a
signature using a weak hash that can easily create collision with
payload that was actually signed using a strong hash.

While it will be a great deal of pain to the client software, but
subject public key information through OID or parameters could specify
one or more hash algorithms to be used with a signature key.  This will
protect against the spoofing of relying party into using a weak hash
during signature verification.  I thought while we are debating the
syntax for ECC based algorithms, this may be a good time to suffer that
pain.

Santosh Chokhani 
Orion Security Solutions, Inc. 
(703) 401-7088 
[email-masked]

---

From: Russ Housley <[email-masked]>
Date: Wed, 20 Sep 2006 21:23:53 -0400

Can you make a presentation in San Diego?

At 03:09 PM 9/20/2006, Santosh Chokhani wrote:

As you know the
hashing algorithms are in state of flux (We know MD5 is bad, SHA-1 is
beginning to smell and so on).

I think we should have a debate on security issues surrounding weak
hashes, specifically relying parties snookered into verifying a signature
using a weak hash that can easily create collision with payload that was
actually signed using a strong hash.

While it will be a great deal of pain to the client software, but subject
public key information through OID or parameters could specify one or
more hash algorithms to be used with a signature key.  This will
protect against the spoofing of relying party into using a weak hash
during signature verification.  I thought while we are debating the
syntax for ECC based algorithms, this may be a good time to suffer that
pain.

Santosh Chokhani

(703) 401-7088

[email-masked]

---

From: Paul Hoffman <[email-masked]>
Date: Wed, 20 Sep 2006 20:35:35 -0700

>payload that was actually signed using a strong hash.

I am confused by the terminology used here. How can a message created 
by one hash easily create a collision with a message created with 
another hash? That would indicate an equal weakness in both hashes, 
wouldn't it?

Could you lay out a specific example?

--Paul Hoffman, Director
--VPN Consortium