Subject: [OPSEC] draft-bhatia-manral-igp-crypto-requirements

From: Vishwas Manral <[email-masked]>
Date: Mon, 23 Feb 2009 20:09:05 -0800

Hi folks,

We now have got some clear guidance regarding this document from the
Security AD's regarding the cryptographic algorithms (Joel has been
privy to those mails). The guidance seems to second what Hugo and
other cryptographers have been stating all along. The crux of what has
been said is:

MD5 should not be used for crypto purposes. SHA-1 though stronger is
also vulnerable. HMAC-MD5 though not yet vulnerable looks highly
suspect and should not be reccomended. HMAC-SHA-1 for now looks ok and
can be reccomended. Goinf forward we should try to reccomend the SHA-2
family of protocols.

With these clear guidances matching what we have in our documents, I
would like to ask the working group to look into this document
further. We can then look at getting this as a WG document.

Thanks,
Vishwas

---

From: Glen Kent <[email-masked]>
Date: Tue, 24 Feb 2009 22:34:21 +0530

So was there any ambiguity in recommending HMAC-SHA1 over other
available options ever?

I re-read the document, found it extremely simple, the recommendations
look right, found it just to be what OPSEC must own up.

Glen

On Tue, Feb 24, 2009 at 9:39 AM, Vishwas Manral <[email-masked]> wrote:
> _______________________________________________
> OPSEC mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/opsec
>

---

From: Vishwas Manral <[email-masked]>
Date: Tue, 24 Feb 2009 10:19:41 -0800

Hi Glen,

Thanks for your support of the document.

There was no ambiguity as such, however Ran wanted us to look further
into whether the recently announced vulnerabilities to SHA-1 and MD5
would effect the reccomendation for HMAC-SHA-1.

Thanks,
Vishwas

---

From: Joel Jaeggli <[email-masked]>
Date: Wed, 25 Feb 2009 14:19:28 -0800

> would effect the reccomendation for HMAC-SHA-1.

We have the issue of vulnerable today vs problematic today, or
tomorrow... I feel very comfortable saying there are some places where
md5 is used today that I'd really prefer to not be using it in 5 years.

That's good advice to have especially on the operational side.

stating that is being proactice.

joelja

---

From: Vishwas Manral <[email-masked]>
Date: Wed, 25 Feb 2009 20:18:17 -0800

Hi Joel,

Thanks for your comment on the document.

> md5 is used today that I'd really prefer to not be using it in 5 years.
If I understood you right, you are saying stating the fact that its
used now though we would prefer it was not used. That was the exact
idea of MUST-, SHOULD+ etc we had used in the document earlier.

It gives an idea of direction of where the support of a particular
algorithm is heading towards. However based on the comments in the
list we modified the document to use standard IETF terminology.

Thanks,
Vishwas

---

From: Joel Jaeggli <[email-masked]>
Date: Wed, 25 Feb 2009 21:56:06 -0800

> idea of MUST-, SHOULD+ etc we had used in the document earlier.

I side with Sandra Murphy on the value of that particular language. If
my concern is that I should not be running something in the future I
want to simply state that. we take that concern expressed in an
informational document back to implementation.

> list we modified the document to use standard IETF terminology.

Which I concur with.

joel

---

From: "Bhatia, Manav (Manav)" <[email-masked]>
Date: Thu, 26 Feb 2009 12:32:34 +0530

Hi,

The latest version of the above draft can be found here:

http://www.ietf.org/internet-drafts/draft-bhatia-manral-igp-crypto-requirements-03.txt

To cite one example, the draft in section 4.2 recommends the following for OSPFv2:

"This section details the authentication algorithm requirements for standards conformant OSPF implementations. 
    
Keyed MD5 is a MUST as defined in [RFC2328]. It is our understanding that this will get superseded by HMAC-SHA-1 as defined in [OSPF-HMAC]. Keyed MD5 thus MUST be implemented, but its use may get deprecated in future. Implementations should start providing support for HMAC-SHA-1 as this will get promoted to a MUST in the future. 
    
Operators should meanwhile start migrating towards HMAC-SHA-1 if they want to use stronger cryptographic algorithms for authenticating their OSPFv2 packets. 
    
Implementations may start providing support for HMAC-SHA-256/HMAC-SHA-384/HMAC-SHA-512 as these algorithms may get upgraded to a SHOULD in the future."

This way we've retained the IETF terminology while giving an idea of where a particular algorithm is headed in the future.

Cheers, Manav

P.S.

[OSPF-HMAC] Bhatia, M., Manral, V., et al., "OSPF HMAC-SHA Cryptographic Authentication", Work in Progress 

This draft is very mature, and an implementation is already underway. It should be "WG last called" pretty soon in the OSPF WG. [ISIS-HMAC] mentioned in the draft has already been published as RFC 5310 (http://tools.ietf.org/rfc/rfc5310.txt).

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] 
> On Behalf Of Joel Jaeggli
> Sent: Thursday, February 26, 2009 11.26 AM
> To: Vishwas Manral
> Cc: opsec wg mailing list
> Subject: Re: [OPSEC] draft-bhatia-manral-igp-crypto-requirements
> 
> Vishwas Manral wrote:
> > Hi Joel,
> >