Subject: [Ietf-krb-wg] draft-turner-md4-to-historic and Microsoft use of Md4

From: Sam Hartman <[email-masked]>
Date: Wed, 07 Jul 2010 13:58:38 -0400

Sean, I've mentioned this in private mail, but I believe your draft
should discuss the Microsoft uses of md4 particularly for converting
passwords to key and discuss the impact of attacks on this use before it
is published. I am not intending to imply you're ignoring my comment: it
was made recently. I just wanted to get it into the public discussion so
others could think about it.

It's not entirely clear what properties are desired of a cryptographic
function in these uses.

In the Kerberos string-to-key operation, I think there are at least two
 goals:

1) Take a password of sufficient quality and produce a good key

2) Make it difficult to recover the password given the key.

There may be other goals. This is an area where the Kerberos community
has struggled to come up with security requirements.

It's clear that md4 fails at the second goal. However, it's not clear
that the Microsoft protocol uses of md4 actually try to achieve this
goal.  In the case of Kerberos, one of the main reasons you want to
prevent recovery of the password is so you can use the same password in
different realms without exposing it. For this reason, an identifier of
the principal and realm is included in the key computation. However,
rc4-hmac-md5 (the Kerberos enctype that uses md4 for string2key)
explicitly does not produce different keys for different realms.

So, I'm not actually sure whether one-way is a security goal or not for
this use of md4.

I have not been able to determine the impact of attacks on md4 on its
use as a funtion to produce high-quality keys from high-quality
passwords.

In conclusion, I think we need to be able to tell people what the impact
of the attacks on md4 is on widely deployed uses before publishing.
_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

---

From: Sean Turner <[email-masked]>
Date: Thu, 08 Jul 2010 09:24:56 -0400

Sam,

Definitely not ignoring the comment.  I just wanted to get the -00 
version out before the deadline.  I haven't heard back from the folks 
I queried about this topic.

At least one person has suggested that we can't change this status of 
this I-D (or the MD2 I-D) because it probably came via the independent 
stream (i.e., RSA was just publishing an open publication of 
proprietary specifications).  They suggested it might be better to 
just update the security considerations and not try to move it to 
historic.  Any thoughts?

spt