Subject: [saag] Request for agenda items

From: Tim Polk <[email-masked]>
Date: Fri, 20 Feb 2009 12:56:20 -0500

Folks,

Pasi and I are working on the agenda for saag at IETF 74.  We would  
appreciate any suggestions!

Thanks,

Tim Polk

---

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Fri, 20 Feb 2009 11:06:31 -0800

Should probably raise awareness of the fact that the SHA1-to SHA-n algorithm transition is not going to look anything like the MD5-SHA1 transition.
 
The MD5 to SHA1 transition was relatively painless because almost every cryptographic protocol that supported one also supported the other. In the mid 1990s the fashion was to have redundant algorithms and MD5 and SHA1 came out round about the same time. In particular every browser that supported SSL 2.0 was required to support both.
 
The transition away from SHA1 is going to be a bear. It is going to be very difficult to do without turning off security in a lot of legacy browsers. Note here that I say 'turn off security' and not 'turn off the browsers'. We need to work out a pragmatic transition strategy that delivers the maximum security for the maximum number of people over the maximum amount of time.
 
If we start addressing the problem now we can lay ourselves an insurance policy. If we try to insist on the pristine principles of the PKIX infrastructure we are going to be in deep trouble in about five years time.
 
This problem is particularly bad because there is an increasing use of SSL in embedded devices that are designed with ten to twenty year service lives and have no firmware upgrade plan.

________________________________

From: [email-masked] on behalf of Tim Polk
Sent: Fri 2/20/2009 12:56 PM
To: [email-masked]
Subject: [saag] Request for agenda items

Folks,

Thanks,

Tim Polk
_______________________________________________
saag mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/saag

---

From: Nicolas Williams <[email-masked]>
Date: Wed, 25 Feb 2009 17:24:55 -0600

On Fri, Feb 20, 2009 at 11:06:31AM -0800, Hallam-Baker, Phillip wrote:
> Should probably raise awareness of the fact that the SHA1-to SHA-n
> algorithm transition is not going to look anything like the MD5-SHA1
> transition.
>  
> The MD5 to SHA1 transition was relatively painless because almost
> every cryptographic protocol that supported one also supported the
> other. In the mid 1990s the fashion was to have redundant algorithms
> and MD5 and SHA1 came out round about the same time. In particular
> every browser that supported SSL 2.0 was required to support both.

Well, not really.  Lots of protocols only had MD5 or worse.  What helped
the MD5->SHA-1 transition was that it happened over many years.  The
same is likely to be true of the SHA-1->SHA-n transition.

> If we start addressing the problem now we can lay ourselves an
> insurance policy. If we try to insist on the pristine principles of
> the PKIX infrastructure we are going to be in deep trouble in about
> five years time.

That was a non-sequitur, and many have complained, but sure, I can
ignore it (web apps and browsers never really held to "the pristine
principles of the PKIX infrastructure" -- there has never been a real
PKI for browser apps -- thus your comment is not even technically
correct).

So what's your proposal?  The suicide note thing?

Nico
--

---

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Wed, 25 Feb 2009 17:23:23 -0800

Well yes and no. Agreed that a lot of protocols have a lot more Md5 in than we would wish. But SSL had a fairly strong tow and tended to pull SHA1 along with it.
 
And, yes I agree that practice of cryptography has been much more pragmatic than pristine. Only that tended to be what we did after exhausting all the other alternatives.

I am not sure I have an alternative yet. I have one possible way to solve the problem. There might be a better way.

From: Nicolas Williams [mailto:[email-masked]]
Sent: Wed 2/25/2009 6:24 PM
To: Hallam-Baker, Phillip
Cc: [email-masked]
Subject: Re: [saag] Request for agenda items

Nico
--