Re: [openpgp] "SHA-1 is a Shambles" and forging PGP WoT signatures

Marcus Brinkmann <marcus.brinkmann@rub.de> Sat, 25 January 2020 01:21 UTC

Return-Path: <marcus.brinkmann@rub.de>
X-Original-To: openpgp@ietfa.amsl.com
Delivered-To: openpgp@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AC3CE1200D8 for <openpgp@ietfa.amsl.com>; Fri, 24 Jan 2020 17:21:21 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.999
X-Spam-Level:
X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=rub.de
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id TZ4zoGlgnqfY for <openpgp@ietfa.amsl.com>; Fri, 24 Jan 2020 17:21:19 -0800 (PST)
Received: from out1.mail.ruhr-uni-bochum.de (out1.mail.ruhr-uni-bochum.de [IPv6:2a05:3e00:8:1001::8693:3595]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 48D7F12001B for <openpgp@ietf.org>; Fri, 24 Jan 2020 17:21:19 -0800 (PST)
Received: from mx1.mail.ruhr-uni-bochum.de (localhost [127.0.0.1]) by out1.mail.ruhr-uni-bochum.de (Postfix mo-ext) with ESMTP id 484JB41fPwz8S6W; Sat, 25 Jan 2020 02:21:16 +0100 (CET)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=rub.de; s=mail-2017; t=1579915276; bh=n7ob4SEUlsVUzs/Sih4gQ2N1c3irs3GfXvFfj7mNa4A=; h=Subject:To:Cc:References:From:Date:In-Reply-To:From; b=sgsquKr+Ekij1bMoUfJx+NKmu9KElV8gzwh8zjAa1Cw6a83rgZs653Bbgeh9VY+Uq o/5cYOSfsF936UPBuIp2Nkig8XmspS/peISxVTyIFyRxNwi9bHIBr46wDFs+AM1k6E win8RfQPb6aALmukcqhq9wqFWf03Gu2BJZGH8ABA=
Received: from out1.mail.ruhr-uni-bochum.de (localhost [127.0.0.1]) by mx1.mail.ruhr-uni-bochum.de (Postfix idis) with ESMTP id 484JB40BRqz8S5l; Sat, 25 Jan 2020 02:21:16 +0100 (CET)
X-Envelope-Sender: <marcus.brinkmann@rub.de>
X-RUB-Notes: Internal origin=IPv6:2a05:3e00:c:1001:5054:ff:fe37:b9e4
Received: from mail1.mail.ruhr-uni-bochum.de (mail1.mail.ruhr-uni-bochum.de [IPv6:2a05:3e00:c:1001:5054:ff:fe37:b9e4]) by out1.mail.ruhr-uni-bochum.de (Postfix mi-int) with ESMTP id 484JB33FHkz8S4M; Sat, 25 Jan 2020 02:21:14 +0100 (CET)
X-Virus-Status: Clean
X-Virus-Scanned: clamav-milter 0.102.1 at mx1.mail.ruhr-uni-bochum.de
Received: from [192.168.142.139] (p5DCA4A2E.dip0.t-ipconnect.de [93.202.74.46]) by mail1.mail.ruhr-uni-bochum.de (Postfix) with ESMTPSA id 484JB14GJpzyXl; Sat, 25 Jan 2020 02:21:13 +0100 (CET)
To: Michael Richardson <mcr@sandelman.ca>
Cc: IETF OpenPGP <openpgp@ietf.org>
References: <d8321b24-8836-2702-6b01-242b4cab932f@rub.de> <e4dc8c25-2282-17a8-7e64-cee55f43be84@kuix.de> <602eeb15-fccf-fe61-7b28-7dea35d3af15@rub.de> <25922.1579885251@localhost>
From: Marcus Brinkmann <marcus.brinkmann@rub.de>
Message-ID: <72069ecf-e309-ee4d-8206-705273c64640@rub.de>
Date: Sat, 25 Jan 2020 02:21:14 +0100
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.3.0
MIME-Version: 1.0
In-Reply-To: <25922.1579885251@localhost>
Content-Type: text/plain; charset="utf-8"
Content-Language: en-US
Content-Transfer-Encoding: 8bit
X-Virus-Scanned: clamav-milter 0.99.4 at mail1.mail.ruhr-uni-bochum.de
X-Virus-Status: Clean
Archived-At: <https://mailarchive.ietf.org/arch/msg/openpgp/BybHikldisS2XCe37z3fgQqMoqg>
Subject: Re: [openpgp] "SHA-1 is a Shambles" and forging PGP WoT signatures
X-BeenThere: openpgp@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: "Ongoing discussion of OpenPGP issues." <openpgp.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/openpgp>, <mailto:openpgp-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/openpgp/>
List-Post: <mailto:openpgp@ietf.org>
List-Help: <mailto:openpgp-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/openpgp>, <mailto:openpgp-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sat, 25 Jan 2020 01:21:22 -0000

Hi,

On 1/24/20 6:00 PM, Michael Richardson wrote:
> 
> Marcus Brinkmann <marcus.brinkmann=40rub.de@dmarc.ietf.org> wrote:
>     >> Does this mean, comparing a 20 bytes (40 hex digits) fingerprint, as
>     >> printed by e.g. GnuPG 2.2.x, is no longer a reliable way to verify you
>     >> have obtained the correct key?
> 
>     > The answer to this would formally be "yes", because after creating two
>     > such keys, the attacker could first show you one key, and, later on show
>     > you the other key and if the only thing you remember about the first key
>     > is the fingerprint, you have no way to notice the swap.
> 
> Would the attacker have to control the private keys of both generated keys to
> accomplish this?  I don't entirely see why.

As the collision I am thinking of happens in the modulus MPI, the
attacker would control the modulus and thus the private exponent (public
exponent fixed at 2^16+1).

> Clearly the signatures generated by the two keys (with identical
> fingerprints) would also be different (assume that the signatures were
> calculated on a SHA256 hash, to remove an attack from that side).

Yes. Any signatures made by these keys would be different.

Thanks,
Marcus

-- 
Dipl.-Math. Marcus Brinkmann

Lehrstuhl für Netz- und Datensicherheit
Ruhr Universität Bochum
Universitätsstr. 150, Geb. ID 2/461
D-44780 Bochum

Telefon: +49 (0) 234 / 32-25030
http://www.nds.rub.de/chair/people/mbrinkmann