[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: Crypto agility in SCRAM + draft-josefsson-password-auth?




--On Tuesday, March 18, 2008 11:21:41 AM -0500 Nicolas Williams <Nicolas.Williams@xxxxxxx> wrote:


On Tue, Mar 18, 2008 at 08:27:08AM +0100, Frank Ellermann wrote:
Chris Newman wrote:
> I am not convinced the security value of PBKDF-2
> offsets the additional complexity it adds.

Without asking Google or similar tricks, I have
not the faintest idea what "PBDKDF-2" is.  Is it
worse than "APR1" ?  That is where I'd draw the
line, scripts taking a minute to shuffle 128 bits
on low end platforms are a PITA.

If you're an implementor then reading the relevant spec (RFC2898, "PKCS
# 5: Password-Based Cryptography Specification Version 2.0", section 5.2
-- slightly over one page of text), IMO, is really in order before
claiming that it's too complex.

> It may be not a lot of complexity, but every
> bit matters.

I'm more interested in nanoseconds than in bits,
but I guess that means we agree.

Oh stop it :), read the spec, notice that PBKDF2 is not much more
complex than Chris' Hi(), and go from there.  Both, Chris' Hi() and
PBKDF2 have an iteration count, so the speed of execution is intended to
be variable.

> Everyone's code toolkit includes MD5, but use
> of SHA1 is quite rare in applications at the
> moment.  Switching away from MD5 will create a
> deployment barrier.

+1  I don't think SHA-1 is still rare, but it is
a known dead end, and using MD5 as least common
denominator makes sense.  Very unfair comparison,
MD5 : SHA-1 : xxx ~ ftp : gopher : http

MD5 is much more a dead end than SHA-1.

Or FTP, for that matter. :-)

The comparison is not "unfair"; it's simply "wrong".

Frank, I really wish you would stop spreading FUD. If you have it in your head that SHA-1 and/or people who promote its use are evil, feel free to ignore it, remain stuck in the 20th century, and fail to interoperate with anyone. In the meantime, the rest of us are getting on with life.

The IETF security area has a mandate to avoid use of MD5 in new protocols, in favor of SHA-1 or SHA-256 plus hash agility. That doesn't (yet) apply to HMAC-MD5, because the HMAC construction is believed to be sufficiently strong, but mandating the use of HMAC-MD5 in new protocols will eventually turn into a requirement to implement MD5 in code that otherwise wouldn't need it. That's OK for people using big crypto toolkits which have it anyway, but likely not for embedded devices with limited storage.

-- Jeff