[340] in WWW Security List Archive
Re: Experimental implementation of SimpleMD5
daemon@ATHENA.MIT.EDU (hallam@axal04.cern.ch)
Tue Jan 24 20:54:10 1995
From: hallam@axal04.cern.ch
Date: Tue, 24 Jan 1995 21:28:13 +0100
X-Vms-To: DXMINT::http-wg-request@cuckoo.hpl.hp.com,DXMINT::www-security@ns2.rutgers.edu
Apparently-To: <www-security@ns2.rutgers.edu>
Apparently-To: <http-wg-request@cuckoo.hpl.hp.com>
Reply-To: www-security@ns2.rutgers.edu
Errors-To: owner-www-security@ns2.rutgers.edu
>SimpleMD5 has been implemented in our client and in 2 servers, and works
>nicely as specified.
Ok I have 1 server and 2 clients... any advances?
>Philip Hallam-Baker does not share our enthusiasm for our proposal, and has
>suggested something totally distinct but similar, the details of which are
>at:
>5) Make the scheme as SIMPLE as possible, leaving the meatier issues to
>S-HTTP discussions.
The only enhancements I have extra in my scheme which require extra code are:
1) The authentication of the body
2) The possiblity to use other digests, not just MD5
3) I think I add in an extra MD5 along the way
(1) is not a big deal to implement.
(2) requires no code at all in the case that one decides only to do an MD5
implementation :-)
[OK it might be good form to check strcmp (p2, "RSA-MD5") == 0 :-]
(3) is easy and defeats a whole slew of attacks.
Its not as if I suggested lots of ASN.1 or anything :-) Comming soon: PKCS-7
revealed!
BTW we still need to come to some sort of decision on whether we can have an
HTML form setup that allows the digestified password to be communicated.
I see the digest scheme as an essential adjunct to the public key schemes for
a number of uses, including for connecting to buletin board systems which might
be run by naughty sysops with a penchant for stealing password files.
We have to get whatever scheme we agree on through the IETF. It will methinks
be easier to get a strong system through than a weak one. So if there are *ANY*
minor tweeks that add security we need to add them pronto. Otherwise we will
end up taking the HTTP/1.1 spec off to an IETF meeting and bringing back a
spec with so many boondogles it can be used as a Christmass tree.
[And no I don't think we can sneak it through in the HTTP/1.0 existing
practice spec, too many people would notice]
[-: Its just as well I didn't add the encryption of the message content :-]
Sun Tzu said: -
It is easier to write ten thousand lines of code than get an IETF
meeting to agree to a standard for security.
Phill H-B
