[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [Sip] Good Hash: draft-ietf-sip-fork-loop-fix-03

Cullen Jennings wrote:


On Oct 3, 2006, at 12:52 PM, Robert Sparks wrote:


I take it you are explicitly objecting to the statement that MD5 is a reasonable non-normatively specified choice?
You have also clearly objected to 128 as a suggestion (The text does NOT mandate a length).

RjS


Yes - MD5 is a cryptographic hash and I thought we all agreed that use off cryptographic hash was not the best choice. If we think cryptographic hash ideas are a good idea, then we need to explain why.

Using a cryptographic hash, even in an example, is a huge red flag for any security person reviewing this. The fact that we used this particular one which has significant security issues, is a even bigger issue.

Uh, no. These aren't even remotely comparable. I'm going to make a big leap here
and guess that people aren't trying to actively _attack_ these forking hashes. _That's_
the problem with MD5 with security. If you're just using it as a _hashing_ algorithm
that has a low probability of collisions, it's just fine. That is: unless you're going to
say that the forking hash needs to be resisitant to collisions from an attacker's chosen
text to do something nefarious, the problems with MD5 (or SHA1) don't apply.

Partially I think MD5 is totally lame to use here because it is slow and offer no advantages over better things and partially I am trying to avoid any delays due to security review where someone points out we should not be using MD5 in new protocols.

The only knock in my mind is that it may be slower than something else, but I'd
worry a great deal about the "something else" if collisions are a problem. Just randomly
inventing a good hashing algorithm with good collision properties especially with
similar chosen text is not exactly the easiest thing to do. Since you're relying on this
for carrying state, I think it's a bad idea to not at least do a SHOULD level algorithm(s)
and be very certain that the algorithm you choose actual has the collision resistance
needed. I'm not an expert here by any means, but my recollection is that CRC does
NOT have very good properties that way.

      Mike


If the we can't figure out a reasonable hash to suggest, how should an implementer figure out what to use. I've been trying to say, I don't care what but don't choose a cryptographic one. If people have a good reason for wanting MD5, I'm glad to listen but I just had not heard the reason yet.




_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use sip-implementors at cs.columbia.edu for questions on current sip
Use sipping at ietf.org for new developments on the application of sip



_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use sip-implementors at cs.columbia.edu for questions on current sip
Use sipping at ietf.org for new developments on the application of sip