Re: [Cfrg] [TLS] Additional Elliptic Curves (Curve25519 etc) for TLS ECDH key agreement

[Daniel Kahn Gillmor <[e-mail]>]

On 01/12/2014 07:57 AM, Alyssa Rowan wrote:
>     · Fast hardware performance is a negative in a PBKDF or a Hashcash,
>       which we actually want to be slow to measure out workfactor of
>       brute-force.
>     · But it's a positive in a signature scheme, as long as the hash is
>       strong enough to resist any plausible second-preimage attack.
>     · And it [keccak] is.
>     · A collision would not suffice here.

What makes you say that a collision attack isn't relevant against a
signature scheme?  The classic collision attack against a signature
scheme is:

 * attacker generates A, B, such that H(A) = H(B)
 * attacker asks victim to sign A
 * victim signs A over digest H
 * attacker applies signature to B

This is how the hashclash/rogue-CA project did its work [0], and it's a
conceivable attack against anything from OpenPGP certifications to
document signatures to revision control [1].

Or am i misunderstanding the context in which you're saying that a
collision would not suffice?

Regards,

	--dkg

[0] http://www.win.tue.nl/hashclash/rogue-ca/
[1]
http://joeyh.name/blog/entry/size_of_the_git_sha1_collision_attack_surface/