Subject: RE: [rohc] sigcomp - state_identifier matching an existing one at a STATE-CREATE

From: "Surtees, Abigail" <[email-masked]>
Date: Tue, 17 May 2005 11:57:52 +0100

Hi Cristian,

> cristian: thank you for the explanation.
> just to make sure I've got it right; this movement has to do with
> the following paragraph from the sigcomp rfc:
> 
> 5. The order in which the existing state items are freed is
>       determined by the state_retention_priority, which is 
> set when the
>       state items are created.  The state_retention_priority 
> of 65535 is
>       reserved for locally available states; these states 
> must always be
>       freed first.  Apart from this special case, states with 
> the lowest
>       state_retention_priority are always freed first.  In 
> the event of
>       a tie, then the state item created first in the compartment is
>       also the first to be freed.

Yes, it does.

> 
> cristian: as far as I understand it (I am just a novice in 
> cryptography),
> this discussion does not take into account an attack which 
> "tries" to produce 
> collisions, does it? just curios, in the light of the new weaknesses
> discovered in SHA-1
> (http://www.schneier.com/blog/archives/2005/02/sha1_broken.html), how
> "vulnerable" (to faking/changing states) is now sigcomp?
> 
I'm no cryptographer either.  From an attacker's perspective, creating two pieces of state with the same 20 byte hash doesn't gain anything because the second piece of state will not be created.  Creating a second piece of state with the same first n bytes of hash means that in order for state to be accessed more than n bytes of hash need to be sent.  
If this could be done, then it is possible to restrict how state is accessed, so there is potential for an attack here.

However, according to Paul Hoffman and Bruce Schneier's draft on the subject (<http://www.ietf.org/internet-drafts/draft-hoffman-hash-attacks-03.txt>), it is not the 'collision free' property of the SHA-1 that has been attacked rather than the 'one way' property.  The above attack would require the 'one way' property to be broken, so the weaknesses discovered do not affect the vulnerability of SigComp.

Best regards,

Abbie

Abbie Surtees
Senior Engineer
Roke Manor Research Ltd
Old Salisbury Lane
Romsey, SO51 0ZN
Tel:   +44 (0) 1794 833131

_______________________________________________
Rohc mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/rohc

---

From: lconroy <[email-masked]>
Date: Tue, 17 May 2005 12:06:23 +0100

Hi ROHCers,

On 17 May 2005, at 11:57, Surtees, Abigail wrote:
> it is not the 'collision free' property of the SHA-1 that has been 
> attacked rather than the 'one way' property.
...by which I assume Abbie meant:
  "it IS the 'collision free' property of the SHA-1 that has been 
attacked rather than the 'one way' property"
?
atb,
   Lawrence
---------------------------------------
lawrence conroy    |tel:+44-1794-833666