Re: How to Calculate Signatures?

[[e-mail] ("Hal Finney")]

Ben Laurie writes:
> The hash does include the ID of the hash, and hence the signature does.

Unfortunately, that doesn't protect against the attack.  The ID of SHA-1
is 2 and the ID of RIPEMD-160 is 3.  If SHA-1 were broken badly enough
it's entirely possible that we could find m1 and m2 such that:

SHA1 (2 || m1) == RIPEMD160 (3 || m2).

The mere fact that you feed the hash algorithm ID into the hash algorithm
doesn't stop you from finding collisions with a different, broken hash
algorithm.

The situation is different with RSA, where you do:

RSA_Sign (Alg ID || Hash).

Now, it is impossible to get collisions using two different algorithm ID's
because the algorithm ID is outside the hash.

Hal