<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <html> <head> <meta content="text/html; charset=ISO-8859-1" http-equiv="Content-Type"> <title></title> </head> <body bgcolor="#ffffff" text="#000000"> Hi Stef, No matter how you do it, you'd want the hash algorithm to be part of the algorithm set for future algorithm agility, for example dh-ietf1024-sha256-aes128-cbc-pkcs7. Also, HKDF is an operator (like HMAC), not an algorithm. In other words you can have HKDF-SHA1 or HKDF-SHA256. I agree that MD5 is not recommended. SHA-256 vs. HKDF-SHA256 is clearly an effort vs. security tradeoff. Personally, I would go for SHA256 with AES-128 (AES-256 has some major issues). Thanks,     Yaron On 11/27/2010 12:18 AM, Stef Walter wrote: <blockquote cite="mid:4CF0323C.9060805@gnome.org" type="cite"> <pre wrap="">As implemented (in gnome-keyring at least) the Secret Service algorithm set dh-ietf1024-aes128-cbc-pkcs7 isn't as strong as it should be. After DH key exchange, the resulting 1024 bit key is truncated into a short key used for AES. This is not optimal, and was brought up on the gnome-keyring-list. Here are some ways we can fix it. In either case, for compatibility, we would add a new algorithm set identifier and deprecate the old one. * Use MD5 to derive the key and use AES128 for encryption. However, MD5 is not recommended for use in crypto protocols. * Use SHA256 to derive the key and use AES256 for encryption. * Use HKDF [1] to derive the key. Perhaps more complex than we need? Any other thoughts? Cheers, Stef [1] <a class="moz-txt-link-freetext" href="http://tools.ietf.org/html/rfc5869">http://tools.ietf.org/html/rfc5869</a> </pre> </blockquote> </body> </html>