Subject: 16 Octet Hash

From: Steve Farmer <[email-masked]>
Date: Mon, 13 Jan 2003 12:17:42 +1100

Hi all,

I may be missing something simple here. I am implementing a SMTP 
client using SASL.  However the rfc specifies a 16 octet hash as well 
as a 16 octet MD5 hash.

Since MD4 gives a 16 octet  result , is it OK to use this ?  If not 
what should I be using for the 16 octet hash?

Regards
Steve Farmer
-- 
-------------------------------------------------
Nearly all men can stand adversity, but if you want to test a man's 
character, give him power.
-Abraham Lincoln, U.S. president (1809-1865)
Support free speech; visit http://www.efa.org.au/

Heads Together Services Pty Ltd http://www.hts.com.au
Email: [email-masked]     Tel: 612 9982 6767     Fax: 612 9981 3081

---

From: Lawrence Greenfield <[email-masked]>
Date: Mon, 13 Jan 2003 13:19:03 -0500

Date: Mon, 13 Jan 2003 12:17:42 +1100
   From: Steve Farmer <[email-masked]>
[...]
   I may be missing something simple here. I am implementing a SMTP 
   client using SASL.  However the rfc specifies a 16 octet hash as well 
   as a 16 octet MD5 hash.

What RFC are you talking about? What are you interested in doing?

I can't think of any case where you can freely substitute one hash for
another in an over-the-wire protocol, but your question leaves out too
many details for me to understand what you're trying to do.

Larry

---

From: Steve Farmer <[email-masked]>
Date: Tue, 14 Jan 2003 09:25:50 +1100

Hi Larry,

Apologies for that, I am implementing rfc2831 and it states ...

"Let KD(k, s) be H({k, ":", s}), i.e., the 16 octet hash of the 
string k, a colon and the string s.

    Let HEX(n) be the representation of the 16 octet MD5 hash"

Soi I am wondering what to use for the 16 octet hash

Regards
Steve

---

From: Lawrence Greenfield <[email-masked]>
Date: Mon, 13 Jan 2003 17:30:15 -0500

Date: Tue, 14 Jan 2003 09:25:50 +1100
   From: Steve Farmer <[email-masked]>

As it says, you must use MD5, as described in RFC 1321. The output of
MD5 is 128-bits (16 octets) long. HMAC-MD5 is described RFC 2104.

You should use exactly the hash operation that is specified.

The document is a little unclear at this point. "HEX(n)" means, given
n, the 128-bit output of a previous MD5 or HMAC-MD5 operation, encode
it in 32 hex digits.

Larry

---

From: Steve Farmer <[email-masked]>
Date: Tue, 14 Jan 2003 09:35:34 +1100

Larry,

Thanks mate , I had assumed that but I wanted to be clear.

Regards from "Down Under"

Steve

---

From: Tony Hansen <[email-masked]>
Date: Mon, 13 Jan 2003 17:44:18 -0500

> n, the 128-bit output of a previous MD5 or HMAC-MD5 operation, encode

... using lower case ...

	Tony Hansen
	[email-masked]

---

From: Ken Murchison <[email-masked]>
Date: Mon, 13 Jan 2003 18:37:17 -0500

> Apologies for that, I am implementing rfc2831 and it states ...

FYI, you might want to look at the the RFC 2831bis draft, which has some
corrections/clarifications:

http://www.ietf.org/internet-drafts/draft-melnikov-rfc2831bis-02.txt

-- 
Kenneth Murchison     Oceana Matrix Ltd.
Software Engineer     21 Princeton Place
716-662-8973 x26      Orchard Park, NY 14127
--PGP Public Key--    http://www.oceana.com/~ken/ksm.pgp

---

From: Lawrence Greenfield <[email-masked]>
Date: Mon, 13 Jan 2003 13:19:03 -0500

Larry

---

From: Steve Farmer <[email-masked]>
Date: Tue, 14 Jan 2003 09:25:50 +1100

Hi Larry,

Regards
Steve

---

From: Lawrence Greenfield <[email-masked]>
Date: Mon, 13 Jan 2003 17:30:15 -0500

Larry

---

From: Steve Farmer <[email-masked]>
Date: Tue, 14 Jan 2003 09:35:34 +1100

Larry,

Steve

---

From: Tony Hansen <[email-masked]>
Date: Mon, 13 Jan 2003 17:44:18 -0500

... using lower case ...

	Tony Hansen
	[email-masked]

---

From: Ken Murchison <[email-masked]>
Date: Mon, 13 Jan 2003 18:37:17 -0500