Subject: RE: Protecting Against Weak Hash Algorithms

From: "Santosh Chokhani" <[email-masked]>
Date: Fri, 22 Sep 2006 14:06:31 -0700

May be the vendors should respond as to what the installed base of ECDSA
is and if they see it worthwhile to include hash OID(s) in the subject
public key algorithm and the attendant change to the software and
installed based of ECDSA certificates.

-----Original Message-----
From: Paul Hoffman [mailto:[email-masked]] 
Sent: Friday, September 22, 2006 4:27 PM
To: Santosh Chokhani; [email-masked]
Subject: RE: Protecting Against Weak Hash Algorithms

At 12:56 PM -0700 9/22/06, Santosh Chokhani wrote:
>Do you see interoperability problems with defining new ECDSA OIDs?

Of course, if people are still expecting the old ones in certs they
receive.

--Paul Hoffman, Director
--VPN Consortium

---

From: Daniel Brown <[email-masked]>
Date: Fri, 22 Sep 2006 17:52:48 -0400

Santosh, Paul,

Inclusion of hash OIDs in the subject public key info field is an option 
in the current proposed syntax. Similarly, it is an option in the RFC 4055 
for RSA-PSS and RSA-OAEP.

I said in an earlier email there that I knew of neither hash substitution 
attacks nor practical hash inversion attacks.  That said, there are some 
impractical, and thus theoretical considerations one might consider. 
Suppose that Alice has a 384-bit EC public key, because she wants 192 bits 
of security (i.e. very high security).  It is then theoretically 
reasonable for Alice to insist that Bob not to accept her signatures if 
they are signed with SHA-1, because SHA-1 has a maximum of 160 bits of 
security against preimage attacks.  Admittedly, this is theoretical 
concern, because we don't foresee 160-bit attack being practical for the 
next 20 years or more.  Anyway, Alice could indicate this by putting 
ecdsa-with-Sha384 in the subject public key info of her cert, if she 
wanted to this paranoid.

Thanks,

Dan Brown
(905) 501-3857
http://www.certicom.com