Re: sha-0 and md5 breaks

This bit of writing from Bruce Schneier's CRYPTO-GRAM may interest
everyone following the SHA-1 discussion. It's a very high-level
overview, but it very much supports Bram's position of, it's not
broken yet, but we might want to move to a different hashing function
in the next release.

          Cryptanalysis of MD5 and SHA

At the CRYPTO conference in Santa Barbara, CA, last month, researchers 
announced several weaknesses in common hash functions.  These results, 
while mathematically significant, aren't cause for alarm.  But even so, 
it's probably time for the cryptography community to get together and 
create a new hash standard.

One-way hash functions are a cryptographic construct used in many 
applications.  They are used in conjunction with public-key algorithms 
for both encryption and digital signatures.  They are used in integrity 
checking.  They are used in authentication.  They have all sorts of 
applications in a great many different protocols.  Much more than 
encryption algorithms, one-way hash functions are the workhorses of 
modern cryptography.

In 1990, Ron Rivest invented the hash function MD4.  In 1992, he 
improved on MD4 and developed another hash function: MD5.  In 1993, the 
National Security Agency published a hash function very similar to MD5, 
called SHA (Secure Hash Algorithm).  Then, in 1995, citing a newly 
discovered weakness that it refused to elaborate on, the NSA made a 
change to SHA.  The new algorithm was called SHA-1.  Today, the most 
popular hash function is SHA-1, with MD5 still being used in older 
applications.

One-way hash functions are supposed to have two properties.  One, 
they're one way.  This means that it is easy to take a message and 
compute the hash value, but it's impossible to take a hash value and 
recreate the original message.   (By "impossible" I mean "can't be done 
in any reasonable amount of time.")  Two, they're collision free.  This 
means that it is impossible to find two messages that hash to the same 
hash value.  The cryptographic reasoning behind these two properties is 
subtle, and I invite curious readers to learn more in my book "Applied 
Cryptography."

Breaking a hash function means showing that either -- or both -- of 
those properties are not true.  Cryptanalysis of the MD4 family of hash 
functions has proceeded in fits and starts over the last decade or so, 
with results against simplified versions of the algorithms and partial 
results against the whole algorithms.  This year, Eli Biham and Rafi 
Chen, and separately Antoine Joux, announced some pretty impressive 
cryptographic results against MD5 and SHA.  Collisions have been 
demonstrated in SHA.  And there are rumors, unconfirmed at this 
writing, of results against SHA-1.

The magnitude of these results depends on who you are.  If you're a 
cryptographer, this is a huge deal.  While not revolutionary, these 
results are substantial advances in the field.  The techniques 
described by the researchers are likely to have other applications, and 
we'll be better able to design secure systems as a result.  This is how 
the science of cryptography advances: we learn how to design new 
algorithms by breaking other algorithms.  Additionally, algorithms from 
the NSA are considered a sort of alien technology: they come from a 
superior race with no explanations.  Any successful cryptanalysis 
against an NSA algorithm is an interesting data point in the eternal 
question of how good they really are in there.

To a user of cryptographic systems -- as I assume most readers are -- 
this news is important, but not particularly worrisome.  MD5 and SHA 
aren't suddenly insecure.  No one is going to be breaking digital 
signatures or reading encrypted messages anytime soon with these 
techniques.  The electronic world is no less secure after these 
announcements than it was before.

But there's an old saying inside the NSA: "Attacks always get better; 
they never get worse."  These techniques will continue to improve, and 
probably someday there will be practical attacks based on these techniques.

It's time for us all to migrate away from SHA-1.

Luckily, there are alternatives.  The National Institute of Standards 
and Technology already has standards for longer -- and harder to break 
-- hash functions:  SHA-224, SHA-256, SHA-384, and SHA-512.  They're 
already government standards, and can already be used.  This is a good 
stopgap, but I'd like to see more.

I'd like to see NIST orchestrate a worldwide competition for a new hash 
function, like they did for the new encryption algorithm, AES, to 
replace DES.  NIST should issue a call for algorithms, and conduct a 
series of analysis rounds, where the community analyzes the various 
proposals with the intent of establishing a new standard.

Most of the hash functions we have, and all the ones in widespread use, 
are based on the general principles of MD4.  Clearly we've learned a 
lot about hash functions in the past decade, and I think we can start 
applying that knowledge to create something even more secure.

Better to do it now, when there's no reason to panic, than years from 
now, when there might be.


<http://news.com.com/Crypto+researchers+abuzz+over+flaws/2100-1002_3-531 
3655.html> or <http://makeashorterlink.com/?Z3F612849>
<http://www.freedom-to-tinker.com/archives/000661.html>
<http://www.mail-archive.com/cryptography%40metzdowd.com/msg02554.html> 
or <http://makeashorterlink.com/?Q20743849>

Technical information:
<http://www.cs.technion.ac.il/users/wwwb/cgi-bin/tr-get.cgi/2004/CS/CS-2 
004-09.ps.gz> or <http://makeashorterlink.com/?O11735849>
<http://www.cs.technion.ac.il/~biham/Reports/Slides/invited-talk-sac-200 
4.ps.gz> or <http://makeashorterlink.com/?T23731849>

NIST's SHA site:
<http://csrc.nist.gov/CryptoToolkit/tkhash.html>

This essay originally appeared in Computerworld:
<http://www.computerworld.com/printthis/2004/0,4814,95343,00.html>


On Tue, 7 Sep 2004 07:32:48 -0700 (PDT), Bram Cohen
<[email protected]> wrote:
> BitTorrent currently uses sha-1, a different algorithm from the recently
> broken sha-0 and md5. While those attacks raise some concern, there aren't
> critical right now, since -
> 
> * The attacks don't (yet) work on sha-1.
> 
> * The attacks are birthday attacks, not pre-image attacks, which are what
> would be what would cause a security concern for BitTorrent.
> 
> That said, I'm going to hold off on deciding on what secure hash algorithm
> to use for bt2 until the dust settles. My current best guess is it will be
> sha-256.
> 
> In other bt2 news, I'm fairly certain at this point that the one-the-wire
> piece size will be 16k, as a hard-coded magic number. The larger piece
> size will probably also be a magic number, but I'm less sure of that
> value, probably somewhere around a quarter meg. Yay magic numbers.
> 
> Also, for the merkle hash trees the very last piece will always be padded
> out with zeros rather than be shorter than everything else, because I'm
> sick of all the stupid edge cases that was causing. The padding will of
> course not be actually sent down the wire.
> 
> Some of you may have noticed that work on ipv6 support has stalled. That's
> because ipv6 addresses are bigger than ipv4 addresses, and the bandwidth
> taken up by sending those around can hurt trackers, which are already the
> bottleneck on the whole system. Since it's mostly something I want to
> support just on principle with no immediate benefit, and it appears to be
> a real problem, it's been put off until later.
> 
> -Bram
> 
> 
> 
> Yahoo! Groups Links
> 
> 
> 
> 
>



------------------------ Yahoo! Groups Sponsor --------------------~--> 
$9.95 domain names from Yahoo!. Register anything.
http://us.click.yahoo.com/J8kdrA/y20IAA/yQLSAA/dkFolB/TM
--------------------------------------------------------------------~-> 

 
Yahoo! Groups Links

<*> To visit your group on the web, go to:
    http://groups.yahoo.com/group/BitTorrent/

<*> To unsubscribe from this group, send an email to:
    [email protected]

<*> Your use of Yahoo! Groups is subject to:
    http://docs.yahoo.com/info/terms/