Subject: [saag] SAAG minutes for IETF73

From: <[email-masked]>
Date: Mon, 1 Dec 2008 15:01:33 +0200

The draft minutes for SAAG session are now available:
http://www.ietf.org/proceedings/08nov/minutes/saag.txt

Big thanks to David Cooper and Paul Hoffman for taking notes!

Please send any corrections and/or additions to me and Tim.

Best regards,
Pasi
_______________________________________________
saag mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/saag

---

From: [email-masked]
Date: Mon, 1 Dec 2008 10:45:56 -0500

>  * David Black and Lakshminath Dondeti had questions about how many 
>   current protocols that might be helped by an insecure hash function.

At least my question was more about degrees of insecurity, specifically
I agree with Ekr that pre-image resistance may not be needed in many
cases, but I am concerned that collision resistance may still be
important.

> * Vidya Narayanan asked whether Eric's requirements for speed was
really 
>   appropriate.  David Black responded that people that do care about 
>   speed just use GCM in a lot of applications.

The longer version of my comment is that the strong interest in GCM in
storage space is evidence that hardware speed & efficiency do matter
to at least one community (GCM's hash is much more efficient and
easier to implement in hardware than any of the SHA hashes).

In addition, the GHASH construct in GCM might be a starting point for
the sort of insecure hash that Ekr was discussing.

Thanks,
--David 

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On 
> Behalf Of [email-masked]
> Sent: Monday, December 01, 2008 8:02 AM
> To: [email-masked]
> Subject: [saag] SAAG minutes for IETF73
> 
>

---

From: <[email-masked]>
Date: Fri, 5 Dec 2008 10:12:40 +0200

Hi David,

Thanks for the corrections! I've updated the minutes as noted below:

> At least my question was more about degrees of insecurity,
> specifically I agree with Ekr that pre-image resistance may not be
> needed in many cases, but I am concerned that collision resistance
> may still be important.

I rephrased this as follows:

* David Black and Lakshminath Dondeti had questions about how many 
  current protocols that might be helped by an insecure hash function.
  David was concerned that even if pre-image resistance is not needed,
  collision resistance may still be important.

> >   really appropriate.  David Black responded that people that do
> >   care about speed just use GCM in a lot of applications.
> 
> The longer version of my comment is that the strong interest in GCM
> in storage space is evidence that hardware speed & efficiency do
> matter to at least one community (GCM's hash is much more efficient
> and easier to implement in hardware than any of the SHA hashes).
> 
> In addition, the GHASH construct in GCM might be a starting point
> for the sort of insecure hash that Ekr was discussing.

Rephrased as follows:

* Vidya Narayanan asked whether Eric's requirements for speed was really 
  appropriate.  David Black responded that strong interest in GCM
  in storage space is evidence that hardware speed and efficiency
  do matter to at least one community.

Best regards,
Pasi