Re: [Isis-wg] draft-bhatia-manral-crypto-req-isis-01.txt

James,

I agree it is hard to get two valid inputs with the same hash. However 
from what I was told, many characters not part of the standard character 
set and hence are invisible(so just the same as if they were not there).

That is the reason I gave the example given by the security people for 
the collision attack. I agree it is not IS-IS related and we can 
probably shift this discussion to some security list (we have discussed 
this on RPSec a couple of years back and I am giving you the gist of the 
discussion there).

Thanks,
Vishwas

James Carlson wrote:
> Vishwas Manral writes:
>   
>> What I mean is not that hashing wont have collisions, but that finding 
>> them should not be easy. That was the intention. I gave you the typical 
>> example served for the same about two documents with the same hash and 
>> hence the same signature.
>>     
>
> There's a huge difference between being able to find collisions with
> arbitrary input, and being able to find a collision on specifically
> modified input.
>
> In other words, there's a serious threat if someone can use known good
> messages to construct a new and different message that's syntactically
> correct and meaningful with a hash that passes validation.
>
> As far as I know, nobody knows how to do that for MD5, and conflating
> an academic exercise with a security problem in an actual protocol is
> probably not a worthwhile contribution.
>
>   

_______________________________________________
Isis-wg mailing list
Isis-wg@ietf.org
https://www1.ietf.org/mailman/listinfo/isis-wg