Re: Working Group Last Call: draft-melnikov-digest-to-historic-00.txt

[Simon Josefsson <simon@xxxxxxxxxxxxx>]

Paul Leach <paulle@xxxxxxxxxxxxxxxxxxxxx> writes:

>>1) One of the main disadvantages with DIGEST-MD5 for me is that its
>>   cryptographic primitives are sub-standard by today's standard.  The
>>   text in 7.B touches on this, but seems misplaced as 7 is about
>>   missing features.  I suggest adding to section 1:
>>
>>   8. The cryptographic primitives in DIGEST-MD5 are not up to today's
>>   standards, in particular:
>>
>>      A. The MD5 hash is sufficiently weak to make a brute force attack
>>      on DIGEST-MD5 easy with common hardware.
>>
>>      B. Using the RC4 algorithm for the security layer without
>>      discarding the initial key stream output is prone to attack.
>>
>>
>
> [Paul Leach] While I certainly agree that MD5 is suspect, I'm not
> aware that there are any known attacks on the usage in DIGEST. The bad
> usage is: given a hash and a known input, it is possible to find other
> inputs that yield the same hash. However, given an input part of which
> is unknown (secret) and a hash, I wasn't aware that it is
> computationally feasible to do better than to try to test all possible
> secrets. Have I missed the relevant paper?

That text is already in the document, so they aren't my words.

However, I recall that there were a presentation at an appsarea meeting
a few IETF meetings ago, where CRAM-MD5 (dictionary?) attacks were
discussed and the practical consequences weren't pretty.  I wasn't there
and don't recall more details though, maybe someone else know of a
better reference.

/Simon