Re: SHA-1 broken

To: securityfocus@xxxxxxxxxxxxxxxxxxxx
Subject: Re: SHA-1 broken
From: Paul Johnston <paul@xxxxxxxxxxxxxxxx>
Date: Mon, 21 Feb 2005 11:02:08 +0000
Cc: bugtraq@xxxxxxxxxxxxxxxxx
In-reply-to: <20050219095333.7569.qmail@xxxxxxxxxxxxxxxxxxxxx>
List-help: <mailto:bugtraq-help@securityfocus.com>
List-id: <bugtraq.list-id.securityfocus.com>
List-post: <mailto:bugtraq@securityfocus.com>
List-subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
List-unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
Mailing-list: contact bugtraq-help@xxxxxxxxxxxxxxxxx; run by ezmlm
References: <20050219095333.7569.qmail@xxxxxxxxxxxxxxxxxxxxx>
User-agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.7.2) Gecko/20040804 Netscape/7.2 (ax)

Hi,

In much the same way if the original text was 'I owe you 1 million dollars' and the 
collision text was 'sdf86*&6989h,mni lkj99j' its not significant.

I think that kind of collision affects the "non-repudiation" property ofdigital signatures. In court, A produces message "I owe you 1 milliondollars" signed by B. B says, "No... I signed a random string providedby A to prove my identity, I've been setup to sign this colliding message".


Regards,

Paul

--
Paul Johnston, GSEC
Internet Security Specialist
Westpoint Limited
Albion Wharf, 19 Albion Street,
Manchester, M1 5LN
England
Tel: +44 (0)161 237 1028
Fax: +44 (0)161 237 1031
email: paul@xxxxxxxxxxxxxxxx
web: www.westpoint.ltd.uk

References:
- Re: SHA-1 broken
  - From: securityfocus

Prev by Date: Re: Joint encryption?
Next by Date: Re: Joint encryption?
Previous by thread: Re: SHA-1 broken
Next by thread: Re: SHA-1 broken
Index(es):
- Date
- Thread