[Full-disclosure] Chinese Professor Cracks Fifth Data Security Algorithm (SHA-1)

[Valdis.Kletnieks at vt.edu]

On Sat, 24 Mar 2007 11:48:10 CDT, wac said:

> Of course not, is enough to find a collision and you'll get for example a
> message signed by somebody else that looks completely authentic since
> signatures encrypt that hash with the private key.

No, if you have a signature to some text, you need to find a collision to a
specified value - the one the signature covers.  For instance, if you have
a 16 bit hash, finding two texts that both have a hash value of 0x1F6E doesn't
do you much good if the signature is for 0x4ED2.  And due to the birthday
paradox, finding any pair of colliding hashes is a lot easier than finding
a collision to a specific hash.

And being able to force a collision to a specific hash may not be very
useful all by itself - for instance, if you're trying to collide the hash
that the PGP signature covers in this message, you *might* be able to find
a string of bits.  But you won't be able to make it a *plausible* signature
unless your string of bits is *also* a chunk of English text, that reads as
if I wrote it.  So not only do you need to be able to collide a specific
hash, you need to do so with at least *some* control over the content of
the text, which is even harder.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 226 bytes
Desc: not available
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20070324/43a4543e/attachment.bin