Donald E. Eastlake 3rd +1-508-786-7554 Donald.Eastlake@motorola.com TSIG SHA etc. Donald E. Eastlake 3rd +1-508-786-7554 Donald.Eastlake@motorola.com March.

Slides:

Advertisements

Similar presentations

Hash Function. What are hash functions? Just a method of compressing strings – E.g., H : {0,1}*  {0,1} 160 – Input is called “message”, output is “digest”

Advertisements

Resource Certificate Profile Geoff Huston, George Michaelson, Rob Loomans APNIC IETF 67.

11 Authentication Algorithm Trade Study CCSDS Security WG Fall 2005 Atlanta, GA USA Howard Weiss NASA/JPL/SPARTA September.

Cryptography and Network Security Chapter 12 Fourth Edition by William Stallings Lecture slides by Lawrie Brown.

Hash functions a hash function produces a fingerprint of some file/message/data h = H(M)  condenses a variable-length message M  to a fixed-sized fingerprint.

Cryptography and Network Security Chapter 12

Cryptography and Network Security Hash Algorithms.

Cryptography and Network Security (CS435) Part Ten (Hash and MAC algorithms)

Cryptography and Network Security Chapter 12 Fourth Edition by William Stallings Lecture slides by Lawrie Brown.

Cryptography and Network Security Third Edition by William Stallings Lecture slides by Lawrie Brown.

Hash and MAC Algorithms Dr. Monther Aldwairi New York Institute of Technology- Amman Campus 12/3/2009 INCS 741: Cryptography 12/3/20091Dr. Monther Aldwairi.

March 2008Protocol Draft Changes -06 to -071 TRILL Protocol Specification Changes from -06 to -07 Donald Eastlake 3 rd

INRIA Rhône-Alpes - Planète research group Reed-Solomon FEC I-D LDPC-* FEC I-D TESLA I-D Simple-auth I-D IETF 70 th – Vancouver meeting, November 2007.

Simple Authentication schemes for ALC and NORM draft-ietf-rmt-simple-auth-for-alc-norm-00 IETF 73 – Minneapolis, November 2008 Vincent Roca (INRIA)

Chapter 21 Public-Key Cryptography and Message Authentication.

Hash and MAC Functions CS427 – Computer Security

1 Authentication Algorithm Document Discussions CCSDS Security Working Group Fall 2007 Meeting 3-5 October 2007 ESA/ESOC, Darmstadt Germany (Hotel am Bruchsee,

Cryptography Chapter 7 Part 3 Pages 812 to 833. Symmetric Cryptography Security Services – Only confidentiality, not authentication or non- repudiation.

Packet Format Issues #227: Need Shim Header to indicate Crypto Property of packet Do we need to add pre-amble header to indicate if data is encrypted or.

DNSSEC allocations DNSEXT chairs IETF-75 Stockholm 2009/07/29.

11 Authentication Algorithms Discussions CCSDS Security WG Winter 2007 Colorado Springs, Colorado USA Howard Weiss NASA/JPL/SPARTA

1 HIP 5201-bis Update Robert Moskowitz Verizon Telcom and Business Tobias Heer RWTH Aachen University March 31, 2011

IEEE MEDIA INDEPENDENT HANDOVER DCN: xx-ECDSA Title: Discussion on introducing ECDSA to d for group management Date Submitted: July.

Slide 1 July 2006, Montreal, QuebecIETF DNSEXT 2929bis Donald E. Eastlake 3 rd

Identity-Based Signatures for MANET Routing Protocols draft-dearlove-manet-ibs-00 Christopher Dearlove Presented by Ulrich Herberg.

November 2006IETF DNSEXT WG Cookies1 DNS Cookies draft-eastlake-dnsext-cookies-01.txt Donald E. Eastlake 3 rd

March HIP Checksum Coverage draft-dawkins-hip-checksum-coverage-00 XingFeng Jiang, Philip Matthews, Spencer Dawkins IETF 70 – December 2007 Vancouver,

KeyProv PSKC Specification Philip Hoyer Mingliang Pei Salah Machani 74 nd IETF meeting, San Francisco Nov

Slide 1 August 2005, Paris, FranceIETF DNSEXT 2929bis etc. Donald E. Eastlake 3 rd

August 2001 Slide 1 Extensions to TLS Simon Blake-Wilson Certicom David Hopwood Independent Consultant Jan Mikkelsen Transactionware Magnus Nystrom RSA.

ECC Design Team: Initial Report Brian Minard, Tolga Acar, Tim Polk November 8, 2006.

Hash Algorithms Ch 12 of Cryptography and Network Security - Third Edition by William Stallings Modified from lecture slides by Lawrie Brown CIM3681 :

Cryptography and Network Security Third Edition by William Stallings Lecture slides by Lawrie Brown.

Slide 1 November 2005, Vancouver, BCIETF DNSEXT 2929bis etc. Donald E. Eastlake 3 rd

Lecture 8 (Chapter 18) Electronic Mail Security Prepared by Dr. Lamiaa M. Elshenawy 1.

[lafur Guxmundsson DNSEXT co-chair

DNS Cookies draft-eastlake-dnsext-cookies-00.txt

March 2015 TRILL Link Security March 2015 TRILL Link Security

Authenticated Identity

IEEE 802.1AS REV D5.0 Review Comments

Lecture 20 DNS Sec Slides adapted from Olag Kampman

Dan Brown, Certicom Research November 10, 2004

RPSEC WG Issues with Routing Protocols security mechanisms

CSE 4905 IPsec II.

IS-IS WG IS-IS Cryptographic Authentication Requirements

Note Well Any submission to the IETF intended by the Contributor for publication as all or part of an IETF Internet-Draft or RFC and any statement made.

Introduction Used for communication to verify

White Space Map Notification

RBridge Channel Tunnel Protocol

draft-zhang-dnsext-test-result-00

MAC: Message Authentication Code

RFC PASSporT Construction 6.2 Verifier Behavior

Discussion of Some Letter Ballot 52 Comments

RFC PASSporT Construction 6.2 Verifier Behavior

RFC PASSporT Construction 6.2 Verifier Behavior

IETF status of XML Security

Resource Certificate Profile

STIR WG IETF-99 PASSPorT Extension for Resource-Priority Authorization (draft-ietf-stir-rph-00) July, 2017 Ray P. Singh, Martin Dolly, Subir Das, and An.

Resource Certificate Profile SIDR WG Meeting IETF 66, July 2006

RFC Verifier Behavior Step 4: Check the Freshness of Date

Sally Floyd and Eddie Kohler draft-floyd-ccid4-01.txt July 2007

Clause 7 Comment Resolutions

draft-ietf-dtn-bpsec-06

PANA enabling IPsec based Access control

Digital Signature Standard (DSS)

Extended BFD draft-mirmin-bfd-extended

TRILL Header Extension Improvements

draft-ietf-lamps-pkix-shake-00

Presentation transcript:

Donald E. Eastlake 3rd +1-508-786-7554 Donald.Eastlake@motorola.com TSIG SHA etc. Donald E. Eastlake 3rd +1-508-786-7554 Donald.Eastlake@motorola.com March 2005 IETF DNSEXT

TSIG SHA Draft “HMAC SHA TSIG Algorithm Identifiers” draft-ietf-dnsext-tsig-sha-01.txt formerly: draft-eastlake-tsig-sha-*.txt Donald E. Eastlake 3rd In Last Call March 2005 IETF DNSEXT

TSIG Algorithms Current TSIG Proposed Standard [RFC 2845] defines only “HMAC-MD5.SIG-ALG.REG.INT”. Weaknesses in MD5/SHA-1 do not apply to HMAC so it may be OK but: Some people want to use government approved algorithms, i.e., at least SHA-1. Various SHA-224+ algorithms are believed to be stronger than MD5/SHA-1. Some people want to truncate their MACs. March 2005 IETF DNSEXT

Changes Specified by 00 Draft Draft standardized added HMAC algorithm FQDN syntax “TLDs” for all SHAs as follows: SHA1., SHA224., SHA256., SHA384., and SHA512. Defined how to specify truncation with a short MAC size TSIG field. Recommended implementation of SHA1 and 96 bit truncated SHA1, other new algorithms optional, HMAC-MD5 remained the only mandatory algorithm. March 2005 IETF DNSEXT

Changes 00->01 Draft Make implementation of HMAC-SHA-1 and HMAC-SHA-256 MANDATORY in addition to HMAC-MD5. March 2005 IETF DNSEXT

Changes to be made 01->02 Draft Based on comments on list and implementer feedback: Specify error code for “signature too weak” to be the same as missing signature. Specify that truncated signature value in request is used in calculating signature for reply. State that policies SHOULD accept longer signatures than they require and SHOULD reply with a signature at least as long as that in the corresponding query. Say a little more about recent hash function breaks. March 2005 IETF DNSEXT

ECC Key Draft “Elliptic Curve KEYs in the DNS” draft-ietf-dnsext-ecc-key-06.txt formerly draft-schroeppel-dnsind-ecc-*.txt Richard C. Schroeppel Donald E. Eastlake 3rd March 2005 IETF DNSEXT

Elliptic Curve Crypto A Public Key system. Keys, signatures, etc., much more compact than RSA. [RFC 3766] A standard format is needed for interoperability. There are numerous patents and claims related to implementations, etc. This draft now defines both a key format and a signature format using Algorithm #4 previously reserved for this purpose. March 2005 IETF DNSEXT

ECC Draft Problems/Questions Need feedback on draft, ideally from implementers. Is format too general? March 2005 IETF DNSEXT

Other Signature Drafts Being updated and expected to be Last Called: draft-ietf-dnsext-rfc2536bis-dsa-04.txt draft-ietf-dnsext-rfc2539bis-dhk-04.txt March 2005 IETF DNSEXT