Re: Crypto agility in SCRAM + draft-josefsson-password-auth?

[Simon Josefsson <simon@xxxxxxxxxxxxx>]

"Frank Ellermann" <nobody@xxxxxxxxxxxxxxxxx> writes:

>> SHA-1 is not covered by the SHA-2 patent as far as
>> I have understood.
>
> The patent is not the issue, the certification is.
> Please correct me if I got this wrong, but I think
> the plan is to find a new "good" hash until 2012,
> and to phase out SHA-1 until 2010.  For some value
> of "good" not yet published in an Internet draft.

I'm not sure I follow this logic -- MD5 is in an even worse state than
SHA-1 is in this regard.  It is not certified at all, right?  Haven't
people been trying to phase out MD5 since Dobbertin's attack in 1996?

I think our choice should be between HMAC-SHA-1 and HMAC-SHA-256.  I
don't think there are strong technical reasons to chose one over the
other at this point.  I used HMAC-SHA-256 for password-auth.

/Simon