Subject: RE: Protecting Against Weak Hash Algorithms

From: "Santosh Chokhani" <[email-masked]>
Date: Fri, 22 Sep 2006 12:29:01 -0700

Paul,

When you register a new OID for subject public key information and that
OID has in its parameters list the possible hash OIDs, that is not a
change to the certificate syntax since it is dependent on the OID for
the subject public key information.

As to weak and strong hash, I would assume MD4 followed by MD5 and some
day SHA-1 could be candidates.

The one advantage the approach has as we try to revise/define ECDSA OIDs
and syntaxes is that the approach will let the infrastructure dictate
when to stop using SHA-1 by defining the certificate life or by revoking
certificates (e.g., simply a CA certificate).

-----Original Message-----
From: Paul Hoffman [mailto:[email-masked]] 
Sent: Friday, September 22, 2006 3:19 PM
To: Santosh Chokhani; [email-masked]
Subject: RE: Protecting Against Weak Hash Algorithms

At 12:07 PM -0700 9/22/06, Santosh Chokhani wrote:
>Sorry, I misunderstood. However, changing the *certificate* structure
>for an attack that has no practical basis is just as bad (if not
>worse) than changing the signature structure.
>[Santosh Chokhani] How do you see this as a change in certificate
>structure?  All that will be added is parameters to the subject public
>key which by definition are OID dependent.

Are you saying that adding parameters to the subject public key is 
not a change to the certificate?

>[Santosh Chokhani] The problem is that if there is a concern about the
>relying party being fooled into invoking a weak hash while signer used
a
>strong hash, how do we go about solving the problem.

If you are unwilling to define "weak hash" and "strong hash", I do 
not see how this group can decide whether or not your change is 
warranted.

--Paul Hoffman, Director
--VPN Consortium

---

From: Paul Hoffman <[email-masked]>
Date: Fri, 22 Sep 2006 12:54:07 -0700

>the subject public key information.

Thank you for the clarification. If you want people to use new OIDs 
(such as "RSA over SHA-1" instead of today's "RSA"), then people 
using the new OID would have their signatures rejected by receiving 
software that didn't know the new OID, even though the receiving 
software has all the bits needed to validate the signature. I suggest 
that this is not a good idea, and that it will be terribly confusing 
to both software vendors ("which of the OIDs should I use here") and 
users ("he says he signed it with RSA and SHA-1, and I can read other 
certs with those algorithms, why can't I read his?").

>day SHA-1 could be candidates.

Sorry to be so repetitive, but please define "weak". From this 
sentence, you seem to be saying "weak" means has less that expected 
collision resistance because there have been no practical preimage 
attacks on the functions you list. So, either you mean that your 
proposed attack works with a collision attack, or you believe that 
there are practical preimage attacks on those functions. Please 
specify which you believe to be true.

--Paul Hoffman, Director
--VPN Consortium